CVE-2025-6136: Medium SQL Injection in Life Insurance Mgmt System

CVE-2025-6136 is a medium (CVSS 6.3) SQL injection flaw in Projectworlds Life Insurance Management System 1.0. The record says /insertPayment.php passes the recipt_no argument into a database query unsafely, and a public exploit has been disclosed. Fix status: no fixed version is named.

What's affected

• Product: Projectworlds Life Insurance Management System 1.0.
• Affected version: 1.0.
• Vulnerable file and argument: /insertPayment.php, parameter recipt_no.
• Weaknesses: CWE-89 (SQL injection) and CWE-74 (injection).
• Fixed version: None is named in the CVE record. Check the vendor or project page for any update before relying on this.
• Access needed: a low-privilege account is required. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
• Public exploit: the record says the exploit has been disclosed to the public and may be used.
• Known exploited: no, the record is not flagged by CISA KEV.

The score for this entry is 6.3 (Medium). Read the description carefully for the vendor wording, because some of these projects have no maintained release channel.

How to check if you're exposed

First confirm whether you run this software at all. Look at your application inventory, web roots, container images and any package lists for Projectworlds Life Insurance Management System 1.0. If you cannot find it, make sure no team has deployed it as a side project, because tools of this kind are often installed once and forgotten.

Then confirm the version. The record names 1.0 as affected.

# find the vulnerable file in your deployment
find /var/www -name "insertPayment.php" 2>/dev/null

# review how it builds its query (look for string concatenation with request values)
grep -n "recipt_no" insertPayment.php | head
grep -n "mysqli_query\|->query(\|mysql_query" insertPayment.php | head

Replace /var/www with your web root. If you see request values joined into a query string, you have the weakness the record describes.

Look for the path /insertPayment.php in web server logs. Requests to it carrying quote characters, comment markers or SQL keywords in the recipt_no value are worth a closer look. A clean log does not prove you are safe, but unusual hits tell you to treat the system as compromised and rotate any credentials the database holds.

What to do now

1. Find every deployment of Projectworlds Life Insurance Management System 1.0 and note the version.
2. Check the vendor or project page and the references in the CVE record for a patch. The record names none, so do not assume one exists.
3. If you cannot patch, remove the application from the internet or put it behind a VPN or an authenticating reverse proxy.
4. Add a web application firewall rule for SQL injection patterns on /insertPayment.php as a stopgap. It reduces risk but is not a fix.
5. If you maintain the code, change the query to use prepared statements with bound parameters, and validate the recipt_no value.
6. Make sure the application connects to the database with an account that has only the permissions it needs, and rotate the credentials if you suspect misuse.
7. Rescan the project with the free in-browser dependency scan so the dependency and code findings are tracked in one place.

Why it matters

The record assigns CWE-89 and its parent CWE-74. In plain terms, the application builds a database query by joining strings, and one request value goes into that string unchecked. Anything that controls the value can influence the query.

Scoring tools show modest impact numbers for each metric here. In practice the outcome ranges from reading records that should be private to changing data, and it depends on database permissions. Applications that run with a powerful database account are worse off than ones with a narrow account.

If no vendor fix appears, the lasting answer is to replace the software. If Projectworlds Life Insurance Management System 1.0 is running anywhere that handles real data, plan that replacement now. The record does not mark this entry as exploited in the wild. It does say the exploit is public, which lowers the effort for anyone who wants to try it, so expose-and-forget deployments are the ones to fix first.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-6136
• github.com/YZS17/CVE/blob/main/Life_Insurance_Management_Sys (listed in the CVE record, not fetched)
• github.com/YZS17/CVE/blob/main/Life_Insurance_Management_Sys (listed in the CVE record, not fetched)
• vuldb.com/?ctiid.312605 (listed in the CVE record, not fetched)

Last reviewed: 18 October 2026.