A vulnerability was found in Codezips Project Management System 1

CVE-2025-0233 is an unauthenticated SQL injection in Codezips Project Management System 1.0, specifically in /pages/forms/course.php via the course_name parameter. Public PoC material shows boolean, error-based, and time-based payloads plus a sqlmap invocation, so the bug is real and straightforward to exercise against an exposed instance.

The vendor's HIGH 7.3 is technically defensible in a vacuum, but it overstates enterprise urgency. The big downward pressure is deployment reality: this is a small downloadable PHP/MySQL sample app from Codezips, not a broadly deployed enterprise platform, there is no KEV listing or credible in-the-wild activity, and available impact scoring is only low/low/low for confidentiality, integrity, and availability under the CNA vector.

Why this verdict

• Downgrade for population reality: this is not Exchange, Ivanti, or a common edge product; it is a niche Codezips PHP sample app with likely sparse enterprise deployment.
• Downgrade for threat signal: no KEV listing, no campaign reporting, and a very low EPSS input mean there is little evidence attackers care at scale.
• Hold at MEDIUM because the bug is still clean: it is unauthenticated, remote, public-PoC SQLi, so any exposed instance is trivially testable and should not be ignored if you actually run it.

Why not higher?

To justify HIGH or CRITICAL for a 10,000-host program, you need either broad exposure, active exploitation, or a product that commonly sits on an enterprise edge. This has none of those amplifiers. The exploit path is simple, but the reachable population and likely business blast radius are both narrow.

Why not lower?

This is not paperwork noise. The bug is remotely reachable without auth, exploit details are public, and successful SQLi can still expose or corrupt application data on any live instance. If you have this app anywhere internet-facing, it deserves real ownership even if it is not an enterprise-wide emergency.

1. Restrict reachability — Move the app behind VPN, allowlisted reverse proxy, or internal-only access so unauthenticated internet users cannot hit /pages/forms/course.php. Because this is a MEDIUM verdict, there is no noisgate mitigation SLA; if you keep the app, make this part of normal risk reduction rather than an emergency change.
2. Block the vulnerable route — At the web server, reverse proxy, or WAF layer, deny access to /pages/forms/course.php or at minimum inspect and block suspicious course_name payloads. With no vendor fix located, route-level containment is the fastest practical guardrail while you decide whether to retire or fork-maintain the app.
3. Constrain the database account — Ensure the web app's DB user has only the minimum CRUD rights it truly needs and cannot administer the database. That limits post-exploit blast radius if an internal or external attacker lands the injection.
4. Retire or replace the app — If this is a student project, demo app, or orphaned departmental tool, removing it is cleaner than carrying indefinite code-level debt with no published upstream patch. For MEDIUM, plan this in the normal remediation window rather than treating it as a break-glass event.

Run this on the target Linux host or inside the container that serves the PHP app. Invoke it as sudo bash verify-cve-2025-0233.sh /var/www (replace /var/www with your webroot base); root is not strictly required, but read access to the application files is.

#!/usr/bin/env bash
# verify-cve-2025-0233.sh
# Detect likely presence of vulnerable Codezips Project Management System 1.0
# affected by CVE-2025-0233.
#
# Usage:
#   bash verify-cve-2025-0233.sh /var/www
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

BASE="${1:-/var/www}"
FOUND=0
UNKNOWN=0

if [ ! -d "$BASE" ]; then
  echo "UNKNOWN: base path '$BASE' does not exist"
  exit 2
fi

# Find candidate files named exactly course.php under pages/forms
while IFS= read -r -d '' f; do
  FOUND=1

  # Heuristics:
  # 1) exact vulnerable path shape
  # 2) file mentions course_name
  # 3) file contains raw SQL construction patterns typical of vulnerable PHP apps
  if grep -q "course_name" "$f" 2>/dev/null; then
    if grep -Eqi "(select|insert|update|delete).*(course_name|\$_POST\['course_name'\]|\$_REQUEST\['course_name'\])|mysqli_query|mysql_query|->query\(" "$f" 2>/dev/null; then
      echo "VULNERABLE: likely Codezips PMS course handler found at $f"
      exit 1
    else
      UNKNOWN=1
    fi
  else
    UNKNOWN=1
  fi
done < <(find "$BASE" -type f -path "*/pages/forms/course.php" -print0 2>/dev/null)

if [ "$FOUND" -eq 0 ]; then
  echo "PATCHED: no candidate 'pages/forms/course.php' file found under $BASE"
  exit 0
fi

if [ "$UNKNOWN" -eq 1 ]; then
  echo "UNKNOWN: candidate file(s) found but vulnerability signature could not be confirmed"
  exit 2
fi

echo "UNKNOWN: verification inconclusive"
exit 2

Sources

1. NVD entry for CVE-2025-0233
2. OpenCVE record for CVE-2025-0233
3. Public PoC issue with payloads and sqlmap example
4. Codezips product page for Project Management System
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS data and field definitions
7. OSV mirror of CVE affected range
8. Secondary tracker with EPSS percentile view