CVE-2025-6891
📋 TL;DR
A critical SQL injection vulnerability exists in code-projects Inventory Management System 1.0, specifically in the createUser.php file's Username parameter. This allows remote attackers to execute arbitrary SQL commands on the database. All installations of version 1.0 are affected.
💻 Affected Systems
- code-projects Inventory Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, user account creation/modification, privilege escalation, and potential data exfiltration.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Exploit details are publicly available on GitHub and vuldb. SQL injection via Username parameter requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to a supported inventory system or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize Username input in createUser.php
Edit /php_action/createUser.php to implement parameterized queries or proper escaping
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL keywords in Username parameter
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all database queries from the application
🔍 How to Verify
Check if Vulnerable:
Test the /php_action/createUser.php endpoint with SQL injection payloads in Username parameterCheck Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and proper input validation is implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login or user creation attempts with special characters
Network Indicators:
- HTTP POST requests to createUser.php containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/php_action/createUser.php" AND (param="Username" AND value CONTAINS "' OR " UNION " SELECT ")