CVE-2025-1956 – A critical SQL injection vulnerability in code-... (How to Fix)

Q: What is the severity of CVE-2025-1956?

CVE-2025-1956 has a CVSS score of 7.3 (HIGH). A critical SQL injection vulnerability in code-projects Shopping Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter in the admin login page. This affects all installations of Shopping Portal 1.0 with the vulnerable component exposed. Attackers can potentially bypass authentication, access sensitive data, or compromise the database.

📋 TL;DR

A critical SQL injection vulnerability in code-projects Shopping Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter in the admin login page. This affects all installations of Shopping Portal 1.0 with the vulnerable component exposed. Attackers can potentially bypass authentication, access sensitive data, or compromise the database.

💻 Affected Systems

Products:

code-projects Shopping Portal

Versions: 1.0

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: All installations with the vulnerable /Shopping/Admin/index.php file are affected. The vulnerability exists in the default installation.

📦 What is this software?

Shopping Portal by Code Projects

View all CVEs affecting Shopping Portal →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data theft, privilege escalation, and potential remote code execution on the underlying server.

🟠

Likely Case

Authentication bypass allowing unauthorized admin access, followed by data exfiltration or manipulation of shopping portal data.

🟢

If Mitigated

Limited impact if proper input validation and prepared statements are implemented, though some information disclosure may still occur.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit details are publicly disclosed and the vulnerability requires minimal technical skill to exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: https://code-projects.org/

Restart Required: No

Instructions:

No official patch available. Manually fix the vulnerable code by implementing parameterized queries or input validation in /Shopping/Admin/index.php.

🔧 Temporary Workarounds

Input Validation and Sanitization

all

Add server-side validation and sanitization for the password parameter before processing SQL queries.

Edit /Shopping/Admin/index.php to implement prepared statements or proper escaping

Web Application Firewall (WAF)

all

Deploy a WAF with SQL injection protection rules to block malicious payloads.

🧯 If You Can't Patch

Restrict access to /Shopping/Admin/ directory using IP whitelisting or authentication at the web server level.
Monitor database logs for unusual SQL queries and implement rate limiting on the login endpoint.

🔍 How to Verify

Check if Vulnerable:

Check if the file /Shopping/Admin/index.php exists and contains unsanitized password parameter usage in SQL queries.

Check Version:

Check the software version in the application's documentation or configuration files.

Verify Fix Applied:

Test the login functionality with SQL injection payloads to ensure they are properly blocked or sanitized.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed login attempts with SQL-like payloads
Access to admin pages from unexpected IP addresses

Network Indicators:

HTTP POST requests to /Shopping/Admin/index.php containing SQL keywords in parameters

SIEM Query:

source="web_logs" AND uri="/Shopping/Admin/index.php" AND (password CONTAINS "' OR" OR password CONTAINS "UNION" OR password CONTAINS "SELECT")

📊 Metadata

CVE ID: CVE-2025-1956

CVSS v3 Score: 7.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE: CWE-74

EPSS Score: 0.13% exploit probability (32.1th percentile)

Published: March 4, 2025

Last Updated: April 3, 2025

🔗 References

https://code-projects.org/ Product
https://hexotion.notion.site/Shopping-Portal-in-PHP-has-Stored-SQL-injection-vulnerability-in-admin-index-php-1a7bb766cf3280e8bb81eaa59c4c2b74 Exploit,Third Party Advisory
https://vuldb.com/?ctiid.298557 Permissions Required,VDB Entry
https://vuldb.com/?id.298557 Third Party Advisory,VDB Entry
https://vuldb.com/?submit.510696 Third Party Advisory,VDB Entry
https://hexotion.notion.site/Shopping-Portal-in-PHP-has-Stored-SQL-injection-vulnerability-in-admin-index-php-1a7bb766cf3280e8bb81eaa59c4c2b74 Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-1956, you might also want to check these: