CVE-2025-6305 is a high severity (CVSS 7.3) SQL injection (CWE-89) in code-projects Online Shoe Store 1.0. The flaw is in /admin/admin_feature.php, where the product_code parameter reaches a database query unsafely. The record lists no fixed version, so fix the query in your copy or retire the application.
What's affected
The record lists code-projects Online Shoe Store, version 1.0, as affected. The vulnerable file is /admin/admin_feature.php and the injectable input is the product_code parameter. The classification includes CWE-74 (improper neutralization of special elements in output used by a downstream component) and CWE-89 (SQL injection).
The record names no fixed release, which means the work falls to whoever runs the application. The CVSS vector needs no privileges and no user interaction, so any visitor who can reach the page can attempt it. The record also states that the exploit has been disclosed publicly and may be used. It is not marked CISA Known Exploited, so I make no claim of attacks in the wild.
How to check if you're exposed
You can confirm exposure in your own copy without sending anything to a live system. Search the code for the file and the parameter:
find . -path "*admin/admin_feature.php" -type f
grep -n "product_code" ./admin/admin_feature.php
Read how the value reaches the database call. If it is joined into the query text with string concatenation or interpolation, and not bound as a parameter, the page has the flaw. Also check your web server access log for requests to /admin/admin_feature.php that carry quotes, comment markers or SQL keywords in the product_code parameter:
grep "admin/admin_feature.php" /var/log/apache2/access.log | grep -iE "%27|union|sleep|--"
Log lines like that point to probing, not proof of a breach. Look at your database logs and data for changes you cannot explain, and confirm that the application account holds only the rights it needs. A scan that crawls and tests your pages can help find sibling pages with the same pattern.
What to do now
- Find every copy of code-projects Online Shoe Store in your environment, including demo and staging installs.
- Change the query in
/admin/admin_feature.phpto use a prepared statement, and bind the product_code parameter as data. Do the same for every other page that builds queries from input. - Give the database account used by the application the minimum rights it needs, with no administrative or file privileges.
- If you cannot patch the code today, take the application off the public internet or put it behind a login or VPN (the admin path already needs a login, but do not rely on that).
- Review access and database logs for probing, and rotate stored credentials if you see signs of misuse.
- Watch the vendor or project site for an official update, and read it before relying on a patched build.
Why it matters
SQL injection (CWE-89) is what happens when input is treated as part of the query. The database follows whatever the string says, so a visitor can read other rows, change data or, depending on the setup, go further. The fix is old and well understood: parameterised queries, where the query shape is fixed and values are passed separately.
Applications of this size are often built from a tutorial pattern where each page builds its own query string. The same mistake tends to repeat on many pages, which is why one report can be followed by several more in the same product. The record gives 7.3 on the CVSS scale and a public disclosure, so the question is not whether the bug is real but whether your copy is reachable.
Quick check
Is there a patch for CVE-2025-6305?
The record does not name a fixed version, and I did not find one in the sources I read. Fix the query in your own copy, or retire the application, and check the project site for news.
How do I stop SQL injection in PHP code?
Use prepared statements with bound parameters in PDO or mysqli for every query that includes input. Escaping strings by hand is fragile and easy to miss on one page.
Sources
- Safeguard Gold entry for CVE-2025-6305
- Researcher issue report on GitHub
- Free in-browser dependency scan
Last reviewed: 18 October 2026.
