CVE-2025-6611 is a high severity (CVSS 7.3) SQL injection in code-projects Inventory Management System 1.0. The brandStatus argument handled by /php_action/createBrand.php reaches a database query unsafely. The record says an exploit is public. No vendor fix is named, so remove or patch the code.
What's affected
- Product: code-projects Inventory Management System 1.0, a PHP sample project distributed from code-projects.org.
- Affected: version 1.0.
- File and parameter: /php_action/createBrand.php, argument brandStatus.
- Fixed: no fixed version is named in the record or in the public report we read. Check the code-projects site before assuming one exists.
- Severity: the record gives CVSS 7.3 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable, no login and low impact on each of confidentiality, integrity and availability.
The record notes that the exploit has been disclosed to the public and may be used, so assume that anyone can attempt it against an exposed copy.
How to check if you're exposed
Because this is downloadable source code, you check the code and the deployment, not a package version.
find / -name "createBrand.php" 2>/dev/null
grep -rn "brandStatus" /path/to/app/php_action/
If the file exists, look at how it builds its database query. Queries that join the request value directly into the SQL string are the problem; prepared statements with bound parameters are the fix. Then check where the application runs. A copy on a laptop for learning is a different risk from a copy on a public server, or on a company network.
What to do now
- Decide whether the application needs to exist. Sample projects are often installed for a demo and forgotten. If it is not needed, remove it.
- If you keep it, take it off the internet, or put it behind a login and a network allow list.
- Fix the code: change the query in /php_action/createBrand.php to a prepared statement with a bound parameter, and review the other files in the php_action folder for the same pattern, since a project written this way usually repeats it.
- Run the database account with the lowest privileges the application needs, and not as an administrator account.
- Review web and database logs for odd values in brandStatus and for database errors.
- A free in-browser scan at gold.safeguard.sh/scan covers your open source dependencies, and reachability analysis helps you rank which findings sit on code that actually runs.
Why it matters
The class is CWE-74, CWE-89: CWE-89 is SQL injection and CWE-74 is the wider class of injection into a downstream component. The value of the brandStatus argument is placed into a query without safe handling, so characters in the value can change the meaning of the query. We do not describe how, since the fix is well known and does not need that detail.
Most tutorial style PHP projects build SQL with string joins, and this CVE is one of several found in the same code base (another report covers removeCategories.php, CVE-2025-6612). If you use a sample project as a starting point for real work, treat it as unreviewed code. The record does not mark this as exploited in the wild beyond the public disclosure, and it is not on the CISA KEV list. The takeaway is simple: free source code is not free of risk, and each copy you run becomes yours to patch.
Quick check
Is there a patched version of Inventory Management System?
None is named in the record or in the report we read. Fix the query yourself with prepared statements, or stop using the project.
Is it safe on a local machine?
Lower risk, but not zero if the machine is on a shared network. Keep demo apps off public addresses.
Sources
Last reviewed: 18 October 2026.
