CVE-2025-0207 is a high severity SQL injection flaw (CVSS 7.3) in code-projects Online Shoe Store version 1.0, reached through the password argument of /function/login.php. The record lists no patched release, so the fix is to correct the code, restrict access to the app, or retire it.
What's affected
The record names code-projects Online Shoe Store, version 1.0. The weak spot is the password input handled at /function/login.php. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means the issue is reachable over the network, needs no privileges, and has low impact on each of confidentiality, integrity and availability, for a base score of 7.3.
There is no fixed version in the record, and none of the references name one. Treat every copy of this version as affected until you have checked with the project yourself.
The record also says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Public technical detail still lowers the effort needed, so do not wait on that distinction.
How to check if you're exposed
Start with whether you run the product at all. Search your servers and repositories for the file named in the record.
find /var/www -type f -name "login.php"
Then read the file and look at how the password value reaches the database. A query built by joining text together with request data is the pattern to look for.
grep -n "_GET\|_POST\|_REQUEST\|mysqli_query" /path/to/login.php
Finally, check web server logs for requests to that path with odd characters in the password value, such as stray quotes or SQL keywords. Hits do not prove a breach, but they tell you whether anyone has probed it.
If you cannot find the product, run a free scan of your repositories and manifests at gold.safeguard.sh/scan. It reports known CVEs for the dependencies it can see. Keep in mind that a hand-written PHP project may not show up in a package inventory, so a file search on the server is the more reliable check here.
What to do now
- Find every copy of code-projects Online Shoe Store you run, including test and demo servers, and note which ones face the internet.
- Take internet-facing copies offline or place them behind a VPN, a login proxy or an IP allow list until the code is fixed.
- Change the vulnerable query so the password value is passed as a bound parameter in a prepared statement, never joined into the SQL text. Validate its type and length as well.
- Check the other pages in the app for the same pattern. Apps like this tend to repeat one query style across many files.
- Give the database account the app uses only the rights it needs. It should not own the schema or have file or admin privileges.
- Watch the project and the NVD record for a fix, and if the product is a sample or abandoned project, plan to replace it. Check the advisory pages before you rely on any claim of a patch.
- Rescan after changes and add the app to a recurring check so a regression is caught.
Why it matters
This is a classic injection weakness: input from the request is placed into a database query without being kept separate from the query itself. The record maps it to CWE-74 and CWE-89. The database cannot tell data from commands, so a crafted value can change what the query does.
The fix pattern is old and well understood. Prepared statements keep the SQL text fixed and send values separately, which removes the problem at the source. Escaping by hand tends to miss cases, so use it only as a second layer.
This one sits in a sign-in or sign-up path, which is also where credential data is checked. Review those accounts and consider forcing password resets if you saw suspicious requests.
Quick check
Is there a patched version of Online Shoe Store?
The record and its references do not name one. Check the project page and the advisory before assuming there is, and fix the code yourself if you must keep running it.
Is a web application firewall enough?
It can reduce noise and block common patterns, but it is a stopgap. The durable fix is to use parameterized queries in the code.
Sources
The other references in the record are public write-ups of the flaw. They were not fetched or reproduced here, and this post gives no attack steps.
Last reviewed: 19 October 2026.
