EUVD-2025-18844Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /changeUsername.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-6474 is a critical SQL injection vulnerability in code-projects Inventory Management System version 1.0 affecting the /changeUsername.php file, specifically the user_id parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with proof-of-concept availability, making active exploitation likely.
Technical ContextAI
This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), which is a parent category for SQL injection flaws. The root cause stems from inadequate input validation and sanitization of the user_id parameter in /changeUsername.php before it is used in SQL queries. The application fails to employ parameterized queries, prepared statements, or proper escaping mechanisms, allowing attackers to inject malicious SQL syntax. The affected product is code-projects Inventory Management System 1.0, a PHP-based web application. The vulnerability permits database manipulation through HTTP requests to the vulnerable endpoint without requiring authentication or user interaction.
RemediationAI
patch: Monitor code-projects GitHub or official website for security updates and apply immediately upon availability workaround: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in user_id parameter (detect quotes, SQL keywords like UNION, OR, etc.); priority: Medium-term mitigation detection: Set up alerts for failed SQL queries or unusual database access patterns
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today