Which versions of PHP are affected by EUVD-2025-28717?

A critical SQL injection vulnerability in the Online Shoe Store admin panel (CVE-2025-6316) allows unauthenticated remote attackers to compromise the database and potentially access sensitive…

Is there a public PoC exploit available for EUVD-2025-28717?

Yes, a public proof-of-concept exploit is available for EUVD-2025-28717. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-28717?

Within 24 hours: Immediately disable or restrict access to the /admin/admin_running.php endpoint using firewall/WAF rules; assess whether the affected version is deployed in production. Within 7 days: Implement input validation and parameterized queries as temporary controls; conduct database audit for unauthorized access or data exfiltration. Within 30 days: Contact vendor for patch availability; if unavailable, evaluate migration to alternative secure e-commerce platform or apply comprehensive compensating controls; segment admin interfaces from public network.

PHP EUVD-2025-28717

Q: What is the CVSS score of EUVD-2025-28717?

EUVD-2025-28717 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6316 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Online Shoe Store Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28717

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 21:10 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 07:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/admin_running.php. The manipulation of the argument qty leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6316 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /admin/admin_running.php file where the 'qty' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and while the CVSS score is 7.3 (high), the attack vector is network-based with low complexity, indicating active exploitation is feasible.

Technical ContextAI

This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), specifically SQL injection. The Online Shoe Store application fails to properly validate or parameterize SQL queries when processing the 'qty' (quantity) parameter in the administrative interface at /admin/admin_running.php. Rather than using prepared statements or parameterized queries, the application concatenates user input directly into SQL commands. The affected component appears to handle inventory or order quantity management, a common administrative function in e-commerce applications. This is a classic input validation failure where user-supplied data is treated as executable SQL code without proper escaping or type checking.

RemediationAI

Immediate actions: (1) Update to a patched version of Online Shoe Store if available from code-projects; (2) Implement parameterized queries/prepared statements for all SQL operations, particularly in /admin/admin_running.php where the 'qty' parameter is processed; (3) Apply input validation to the 'qty' parameter ensuring it accepts only numeric values; (4) Use Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the qty parameter (signatures: SQL keywords like UNION, SELECT, OR '1'='1, etc.); (5) Restrict administrative interface access to trusted IP addresses and implement strong authentication mechanisms; (6) Conduct code review of all user input handling in administrative functions. Given the public POC availability, patching should be prioritized within 24-48 hours for exposed instances.