Cyber Posture

CVE-2025-0205

MediumPublic PoC

Published: 04 January 2025

Published
04 January 2025
Modified
22 January 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0007 21.6th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-0205 is a SQL injection vulnerability (CWE-74, CWE-89) classified as critical in the code-projects Online Shoe Store 1.0 application. The flaw resides in an unknown function within the /details2.php file, where manipulation of the 'id' argument enables SQL injection. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L) and was published on 2025-01-04.

The vulnerability is exploitable remotely by an attacker possessing low privileges. Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability.

Advisories from VulDB (ctiid.290142, id.290142, submit.474032) provide further details, including a public exploit disclosed via a GitHub Gist. The project site at code-projects.org hosts the affected software, but no specific patch or mitigation steps are outlined in the CVE description.

The exploit has been disclosed to the public and may be used by attackers.

Details

CWE(s)
CWE-74CWE-89

Affected Products

code-projects
online shoe store
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web app (/details2.php) enables exploitation of public-facing application (T1190), abuse of server software component for potential RCE (T1505 as assigned by VulDB), and data collection from databases (T1213.006) via unauthorized DB queries.

References