CVE-2025-0208
Published: 04 January 2025
Description
A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /summary.php. The manipulation of the argument tid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2025-0208 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting an unknown functionality within the /summary.php file. The issue arises from improper handling of the 'tid' argument, enabling manipulation that leads to SQL injection as classified under CWE-74 and CWE-89. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on January 4, 2025.
The vulnerability is remotely exploitable over the network with low attack complexity and requires low privileges (PR:L), such as an authenticated user account. Attackers can manipulate the 'tid' parameter to inject malicious SQL payloads, potentially resulting in low-impact confidentiality, integrity, and availability violations, such as unauthorized data access or modification within the application's database.
Advisories from VulDB (ctiid.290145, id.290145, submit.474038) document the vulnerability, while the project site at code-projects.org provides context on the affected software. A proof-of-concept exploit is publicly available on GitHub Gist (th4s1s/24925a20d1f9336858dee1cbbb30c249), increasing the risk of widespread use; no specific patches or mitigations are detailed in the available references.
The exploit disclosure heightens the urgency for users of Online Shoe Store 1.0 to review and harden their deployments against SQL injection, particularly in environments exposing the /summary.php endpoint.
Details
- CWE(s)