CVE-2025-6474
📋 TL;DR
CVE-2025-6474 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the user_id parameter in /changeUsername.php. This affects all deployments of version 1.0, potentially leading to data theft, system compromise, or complete database takeover.
💻 Affected Systems
- code-projects Inventory Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, privilege escalation to system-level access, and potential remote code execution through database functions.
Likely Case
Unauthorized data access and modification, credential theft, and potential application-level compromise.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub and vuldb.com. Attack requires access to the change username functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check code-projects.org for official patch or updated version
2. If no patch available, implement workarounds immediately
3. Consider migrating to alternative inventory management solutions
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd strict input validation for user_id parameter to only accept expected formats
Edit /changeUsername.php to add: if(!is_numeric($_POST['user_id'])) { die('Invalid input'); }
Web Application Firewall Rules
allBlock SQL injection patterns targeting /changeUsername.php
WAF rule: deny requests to /changeUsername.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Block external access to /changeUsername.php via firewall rules or web server configuration
- Implement network segmentation to isolate the inventory system from sensitive databases
🔍 How to Verify
Check if Vulnerable:
Test /changeUsername.php with SQL injection payloads in user_id parameter (e.g., 1' OR '1'='1)Check Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by /changeUsername.php access
- Unusual SQL error messages in application logs
- Requests to /changeUsername.php with SQL keywords in parameters
Network Indicators:
- Unusual database connections from web server
- Large data transfers from database to external IPs
SIEM Query:
source="web_logs" AND uri="/changeUsername.php" AND (param="*' OR*" OR param="*UNION*" OR param="*SELECT*" OR param="*INSERT*")