CVE-2025-0299
Published: 07 January 2025
Description
A vulnerability classified as critical has been found in code-projects Online Book Shop 1.0. Affected is an unknown function of the file /search_result.php. The manipulation of the argument s leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2025-0299 is a critical SQL injection vulnerability in code-projects Online Book Shop 1.0, affecting an unknown function within the /search_result.php file. The issue arises from improper handling of the 's' argument, allowing manipulation that leads to SQL injection. It is remotely exploitable and has been assigned CWE-74 and CWE-89, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Remote attackers with low privileges, such as authenticated users, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts including low-level confidentiality, integrity, and availability violations, potentially allowing unauthorized access, modification, or disruption of database operations depending on the backend configuration.
Advisories and details are documented on VulDB (ctiid.290448, id.290448, submit.475285), with a public proof-of-concept exploit available in a GitHub Gist. The vendor site at code-projects.org provides context on the affected Online Book Shop 1.0 application, though no specific patches or mitigations are detailed in the available information.
The exploit has been publicly disclosed and may be used by attackers targeting unpatched instances of this software.
Details
- CWE(s)