A vulnerability

CVE-2025-0208 is a SQL injection in code-projects Online Shoe Store 1.0, specifically summary.php via the tid parameter. The public write-up shows $_GET['tid'] flowing straight into a SQL query against the transaction table, which means a low-privileged user who can reach that page can likely read or alter application data; if the MySQL account is overprivileged, a deeper pivot is possible. The affected version range published by the CNA is only 1.0, and I could not find a vendor-fixed release or patch stream.

The vendor/CNA MEDIUM 6.3 is closer to reality than NVD's 9.8. The decisive issue is attacker position: the CNA scores this as PR:L, and the available exploit narrative lines up with an authenticated application flow rather than a clean unauthenticated edge exploit. Add the fact that this is a downloadable PHP project/demo app with uncertain enterprise footprint, no KEV listing, and a tiny EPSS, and this lands as LOW priority in a 10,000-host patch queue unless you knowingly run this app internet-facing.

Why this verdict

• Start from the CNA's 6.3, not NVD's 9.8 because the published exploit context and app flow support PR:L, not a full unauthenticated edge compromise.
• Authenticated or session-bound access is the governor: needing a valid user foothold implies either self-registration, stolen cookies, or prior access, which materially narrows who can reach exploit step one.
• The target population is narrow: code-projects apps are downloadable sample/demo PHP projects, not broadly deployed enterprise platforms, so the reachable blast radius across a 10,000-host estate is usually tiny.
• Threat demand is weak: there is a public PoC, but there is no KEV listing, no campaign evidence I could find, and EPSS is extremely low.
• Impact is usually app-local: the realistic baseline is reading or tampering with this app's data; database-to-OS pivoting is conditional on extra misconfigurations and should not be baked into the base score.

Why not higher?

If this were clearly unauthenticated and broadly internet-exposed, SQL injection would deserve a much harder response. But the strongest available evidence points the other way: low-privileged access first, niche software, partial impact modeling, and no sign that attackers actually care.

Why not lower?

I am not calling this IGNORE because it is still a real SQL injection with public exploit guidance. If your org actually runs this app exposed to the internet, especially with open self-registration and a powerful DB account, the risk becomes immediately operational even if it does not justify front-of-queue treatment across the whole estate.

1. Restrict access to summary.php — Enforce authenticated access plus strict object ownership checks on transaction records so a logged-in user cannot request arbitrary tid values. For a LOW verdict there is no SLA; treat this as backlog hygiene and implement in the next normal application hardening cycle.
2. Block SQLi patterns on tid — Add a targeted WAF or reverse-proxy rule for summary.php that only allows the expected transaction-ID format and rejects metacharacters, comments, stacked queries, and time-delay payloads. There is no noisgate mitigation SLA for LOW; deploy during routine rule maintenance unless the app is internet-facing, in which case move faster.
3. De-privilege the database account — Remove dangerous MySQL privileges such as FILE, SUPER, and unnecessary write access from the application's DB user to keep a SQLi from turning into filesystem abuse or server takeover. With a LOW verdict this is backlog hygiene, but it materially reduces worst-case impact.
4. Fix the query in source — Replace string interpolation with prepared statements or at minimum strict numeric casting/allowlisting for tid. No vendor-fixed build was found, so plan to patch your maintained codebase in the next routine remediation cycle.

Run this on the target host or on a build artifact checkout that contains the PHP source. Invoke it with python3 check_cve_2025_0208.py /var/www/html/onl-shoe or point it directly at summary.php; it only needs read access to the source files.

#!/usr/bin/env python3
# check_cve_2025_0208.py
# Detect likely vulnerable code patterns for CVE-2025-0208 in code-projects Online Shoe Store 1.0.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
from pathlib import Path

VULN_GET_RE = re.compile(r"\$_GET\s*\[\s*['\"]tid['\"]\s*\]")
VULN_ASSIGN_RE = re.compile(r"\$\w+\s*=\s*\$_GET\s*\[\s*['\"]tid['\"]\s*\]\s*;")
VULN_QUERY_RE = re.compile(r"transaction_id\s*=\s*'\s*\$\w+\s*'", re.IGNORECASE)
SAFE_CAST_RE = re.compile(r"(intval\s*\(|\(int\)\s*\$_GET\s*\[\s*['\"]tid['\"]\s*\])", re.IGNORECASE)
PREPARED_RE = re.compile(r"(prepare\s*\(|bind_param\s*\(|PDO\s*::\s*prepare)", re.IGNORECASE)


def read_text(p: Path):
    try:
        return p.read_text(encoding='utf-8', errors='ignore')
    except Exception:
        return None


def candidate_files(target: Path):
    if target.is_file():
        return [target]
    found = []
    for p in target.rglob('summary.php'):
        found.append(p)
    return found


def assess_file(p: Path):
    text = read_text(p)
    if text is None:
        return 'UNKNOWN', f'{p}: unreadable'

    has_get = bool(VULN_GET_RE.search(text))
    has_assign = bool(VULN_ASSIGN_RE.search(text))
    has_query = bool(VULN_QUERY_RE.search(text))
    has_safe_cast = bool(SAFE_CAST_RE.search(text))
    has_prepared = bool(PREPARED_RE.search(text))

    if has_get and has_query and not has_safe_cast and not has_prepared:
        return 'VULNERABLE', f'{p}: raw tid parameter appears interpolated into SQL query'

    if has_prepared or has_safe_cast:
        return 'PATCHED', f'{p}: found parameterization or strict integer casting for tid'

    if has_get or has_assign or has_query:
        return 'UNKNOWN', f'{p}: suspicious markers found, but pattern does not conclusively match CVE-2025-0208'

    return 'UNKNOWN', f'{p}: summary.php present, but expected markers were not found'


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2025_0208.py <path-to-app-or-summary.php>')
        sys.exit(2)

    target = Path(sys.argv[1])
    if not target.exists():
        print(f'UNKNOWN - target does not exist: {target}')
        sys.exit(2)

    files = candidate_files(target)
    if not files:
        print('UNKNOWN - no summary.php file found under target path')
        sys.exit(2)

    saw_patched = False
    saw_unknown = False
    messages = []

    for f in files:
        verdict, msg = assess_file(f)
        messages.append(msg)
        if verdict == 'VULNERABLE':
            print('VULNERABLE - ' + ' | '.join(messages))
            sys.exit(1)
        if verdict == 'PATCHED':
            saw_patched = True
        if verdict == 'UNKNOWN':
            saw_unknown = True

    if saw_patched and not saw_unknown:
        print('PATCHED - ' + ' | '.join(messages))
        sys.exit(0)

    if saw_patched and saw_unknown:
        print('UNKNOWN - mixed results: ' + ' | '.join(messages))
        sys.exit(2)

    print('UNKNOWN - ' + ' | '.join(messages))
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2025-0208
2. OpenCVE record with CNA and CISA ADP metadata
3. Public PoC gist by th4s1s
4. code-projects product page
5. code-projects download details page
6. CISA vulnerability summary bulletin SB25-006
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS data documentation