CVE-2025-3553 is a medium severity flaw (CVSS 6.3) in phpshe 1.8, an open source shop application. The brand deletion function in the admin script builds a database query from the brand_id array without safe handling, which allows SQL injection. The record lists no fixed version, so limit access and review the advisory.
What's affected
The record says phpshe version 1.8 is affected. The vulnerable code is the pe_delete function reached through the admin script's brand delete action, and the brand_id array argument is the input that leads to injection.
The record lists no fixed version and no vendor advisory. It says the exploit has been disclosed to the public. The references are VulDB entries and a write up from the reporter. Check the project's own channels for any newer release before you decide on a plan. If none exists, treat the application as unpatched.
How to check if you're exposed
- Look at your deployed phpshe version in the project files or the admin panel. Version 1.8 is in scope.
- Check whether the admin path is reachable from the internet. The affected action sits behind the admin script.
- Review web server logs for unusual requests to the brand delete action.
- Read the references in the CVE record to confirm the details for your version.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related advisories.
What to do now
- Restrict the admin area by IP allowlist, VPN or an extra authentication layer at the web server.
- Use a database account for the application with only the rights it needs, so injection cannot reach other schemas or run file operations.
- Put a web application firewall in front of the application as a stopgap, understanding it is not a fix.
- If you have developer capacity, change the code to use parameterised queries.
- Plan a migration to a maintained shop platform if the project is no longer updated.
Why it matters
The weaknesses are CWE-89, SQL injection, and CWE-74, injection in general. User input ends up inside a database command, so the database cannot tell data from instructions. Depending on the account's rights, an attacker could read, change or delete records.
The CVSS vector in the record suggests low privileges are needed, which fits an admin side action. That is why the score is medium and not high. The CVE is not on the CISA Known Exploited Vulnerabilities list. The record does note that the exploit details are public, which lowers the effort needed to try.
Small open source apps often have no security contact and no release cadence. That makes inventory and compensating controls more important.
Quick check
Is there a patch?
The record lists no fixed version. Check the project and the references for updates.
Does a firewall solve it?
It can reduce risk but does not remove the flaw in the code. Restricting access and fixing the query are the real controls.
Sources
Last reviewed: 18 October 2026.
