CVE-2025-0296
Published: 07 January 2025
Description
A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. The manipulation of the argument subcatid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2025-0296 is a critical SQL injection vulnerability (CWE-74, CWE-89) in code-projects Online Book Shop 1.0. The flaw affects an unknown part of the file /booklist.php, where manipulation of the subcatid argument enables SQL injection. Published on 2025-01-07, it carries a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants limited access to confidential data (C:L), allows limited modification of data or processes (I:L), and causes limited denial of service (A:L), all without changing scope.
Advisories from VulDB (ctiid.290445, id.290445, submit.475135) document the issue, while a GitHub gist provides a public proof-of-concept exploit. The project site at code-projects.org is referenced, but no patches or specific mitigations are mentioned in the available details.
The exploit has been disclosed publicly and may be used by attackers.
Details
- CWE(s)