CVE-2025-6841: Product Inventory System SQLi Vulnerability

CVE-2025-6841 Overview

CVE-2025-6841 is a SQL injection vulnerability in code-projects Product Inventory System 1.0. The flaw resides in the /admin/edit_product.php script, where the ID parameter is passed unsanitized into a database query. Authenticated attackers can manipulate the parameter remotely to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
Remote attackers with administrative access can manipulate the ID parameter in /admin/edit_product.php to execute arbitrary SQL queries against the application database.

Affected Products

code-projects Product Inventory System 1.0
Component: fabian:product_inventory_system
File: /admin/edit_product.php

Discovery Timeline

2025-06-29 - CVE-2025-6841 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6841

Vulnerability Analysis

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output). The edit_product.php admin endpoint accepts an ID parameter and concatenates the value into an SQL query without parameterized binding or input sanitization. An attacker who has access to the administrative interface can supply crafted input that alters query syntax.

Successful exploitation allows the attacker to read, modify, or delete records in the inventory database. The CVSS 4.0 vector indicates the attack requires high privileges, which limits exposure to authenticated administrative users. The EPSS probability of 0.33% reflects low predicted exploitation activity at this time.

Root Cause

The root cause is direct concatenation of user-controlled input into a SQL statement within /admin/edit_product.php. The application does not employ prepared statements or input validation routines on the ID parameter, allowing meta-characters such as single quotes and SQL keywords to break out of the intended query context.

Attack Vector

The attack vector is network-based. An authenticated administrator account is required to reach the vulnerable endpoint. Once authenticated, an attacker submits a manipulated ID value through a standard HTTP request. A proof-of-concept has been published on the GitHub PoC Issue #11 repository.

No verified exploit code is reproduced here. Refer to the published advisories for technical reproduction details: VulDB #314284 and VulDB CTI ID #314284.

Detection Methods for CVE-2025-6841

Indicators of Compromise

HTTP requests to /admin/edit_product.php containing SQL meta-characters such as ', --, UNION, or SELECT in the ID parameter
Unexpected database errors logged by the PHP application referencing the edit_product query
New, modified, or deleted product records that do not correspond to legitimate administrator activity

Detection Strategies

Inspect web server access logs for anomalous query strings targeting /admin/edit_product.php
Deploy a web application firewall (WAF) rule set tuned to detect SQL injection payloads against PHP admin endpoints
Enable database query logging and alert on syntactically malformed statements originating from the application user

Monitoring Recommendations

Monitor authentication logs for administrator sessions originating from unfamiliar IP addresses or geographies
Track outbound database queries containing UNION, INFORMATION_SCHEMA, or stacked statements
Correlate administrator session activity with product table changes to detect tampering

How to Mitigate CVE-2025-6841

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only access
Rotate administrator credentials and enforce strong, unique passwords for all admin accounts
Review database audit logs for unauthorized modifications to product records since June 2025

Patch Information

No official vendor patch has been published for code-projects Product Inventory System 1.0. Organizations running this software should consider replacing the application or applying source-level fixes. Refactor /admin/edit_product.php to use parameterized queries (PDO prepared statements or mysqli_prepare) and validate that the ID parameter is a numeric integer before processing.

Workarounds

Apply a WAF rule that blocks non-numeric values in the ID query parameter for /admin/edit_product.php
Place the admin interface behind a reverse proxy that enforces strict request validation
Apply database user least-privilege controls so the application account cannot drop tables or read system schemas

bash

# Example WAF rule (ModSecurity) to reject non-numeric ID values
SecRule REQUEST_URI "@beginsWith /admin/edit_product.php" \
    "chain,deny,status:403,id:1006841,msg:'CVE-2025-6841 SQLi attempt'"
    SecRule ARGS:ID "!@rx ^[0-9]+$"