Which versions of PHP are affected by EUVD-2025-28721?

A publicly disclosed SQL injection vulnerability in the Online Shoe Store admin panel could allow attackers to compromise the database and gain unauthorized access to sensitive customer and business…

Is there a public PoC exploit available for EUVD-2025-28721?

Yes, a public proof-of-concept exploit is available for EUVD-2025-28721. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-28721?

Within 24 hours: Disable or restrict access to /admin/admin_football.php if not critical to operations; implement WAF rules to block SQL injection payloads in the pid parameter. Within 7 days: Deploy network segmentation to limit admin panel access to trusted IP ranges only; audit logs for exploitation attempts. Within 30 days: Contact vendor for patch status; evaluate migration to patched version or alternative solution; conduct forensic analysis if breach indicators are found.

PHP EUVD-2025-28721

Q: What is the CVSS score of EUVD-2025-28721?

EUVD-2025-28721 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6342 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Online Shoe Store Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28721

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 15:43 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 14:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. This issue affects some unknown processing of the file /admin/admin_football.php. The manipulation of the argument pid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6342 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0, specifically in the /admin/admin_football.php file where the 'pid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild.

Technical ContextAI

This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which manifests as SQL injection in the web application's administrative interface. The Online Shoe Store application fails to properly validate or parameterize user input in the 'pid' (product ID) parameter passed to /admin/admin_football.php, allowing attackers to inject malicious SQL syntax. The root cause is improper input validation and lack of prepared statement usage, typical of legacy PHP applications. The affected component appears to be a legacy administrative module handling football-related product data, suggesting inadequate separation of concerns and aging codebase practices.

RemediationAI

Immediate actions: (1) Implement input validation on the 'pid' parameter using whitelist-based approach (accept only numeric values); (2) Use parameterized queries/prepared statements for all SQL operations in admin_football.php; (3) Apply principle of least privilege to database user account for the application (restrict to necessary tables/operations only). Long-term: (1) Upgrade to a maintained e-commerce platform if available from vendor; (2) If code-projects provides patches, apply immediately; (3) If no patches are available, consider migrating to maintained alternatives (WooCommerce, Magento, etc.). Temporary mitigation: (1) Restrict access to /admin/ paths via WAF rules or IP whitelisting; (2) Disable the admin_football.php functionality if not actively used; (3) Monitor database queries for SQL injection patterns.