CVE-2025-6502
📋 TL;DR
This critical SQL injection vulnerability in code-projects Inventory Management System 1.0 allows attackers to manipulate database queries through the user_id parameter in changePassword.php. Remote attackers can potentially access, modify, or delete sensitive data in the database. All users running version 1.0 of this software are affected.
💻 Affected Systems
- code-projects Inventory Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of sensitive data, administrative account takeover, and potential remote code execution through database functions.
Likely Case
Unauthorized access to user credentials, inventory data, and other sensitive information stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only affecting non-sensitive data.
🎯 Exploit Status
Exploit requires authentication to access changePassword.php, but SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates
2. If no patch available, implement workarounds
3. Consider migrating to alternative software
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries and input validation to changePassword.php
Replace raw SQL queries with prepared statements using PDO or mysqli
Access Restriction
linuxRestrict access to changePassword.php file
Add .htaccess rules to limit access to authenticated users only
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Isolate the system from internet access and restrict to internal network only
🔍 How to Verify
Check if Vulnerable:
Check if /php_action/changePassword.php exists and contains unsanitized user_id parameter usageCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test changePassword.php with SQL injection payloads to confirm they're blocked📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Multiple failed password change attempts
- Unusual database queries from web application
Network Indicators:
- HTTP POST requests to changePassword.php with SQL payloads in parameters
SIEM Query:
source="web_server" AND (url="*changePassword.php*" AND (param="*user_id*" AND value="*' OR *"))