EUVD-2025-18840
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Tags
Description
A vulnerability, which was classified as critical, has been found in code-projects Online Bidding System 1.0. Affected by this issue is some unknown functionality of the file /showprod.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6472 is a critical SQL injection vulnerability in code-projects Online Bidding System 1.0 affecting the /showprod.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available, creating immediate risk for exposed instances.
Technical Context
The vulnerability stems from improper input validation on the ID parameter in /showprod.php, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The root cause is insufficient parameterization or escaping of user-supplied input before incorporation into SQL queries. The Online Bidding System, a PHP-based e-commerce application, directly concatenates user input into SQL statements without proper prepared statements or parameterized queries. This allows attackers to inject arbitrary SQL syntax through the ID parameter, bypassing authentication mechanisms entirely (PR:N) and requiring no user interaction (UI:N).
Affected Products
code-projects Online Bidding System version 1.0 (CPE: cpe:/a:code-projects:online_bidding_system:1.0). The vulnerability specifically targets installations with the /showprod.php file accessible via HTTP/HTTPS on the default or custom web application path. All deployment configurations of this version are affected due to the lack of authentication requirements and the central nature of the product listing functionality.
Remediation
Immediate actions: (1) Disable or restrict access to /showprod.php via web application firewall rules if patching cannot be performed immediately; (2) Implement input validation on the ID parameter to accept only numeric values using whitelist patterns; (3) Upgrade to the latest patched version of Online Bidding System (vendor should provide patch details—check code-projects official repository/advisory); (4) Implement parameterized queries or prepared statements throughout the application; (5) Apply principle of least privilege to database user credentials used by the application. Long-term: migrate to actively maintained e-commerce platforms with security-by-design principles.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today