CVE-2025-0405
Published: 13 January 2025
Description
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
Security Summary
CVE-2025-0405 is a critical SQL injection vulnerability affecting liujianview gymxmjpa version 1.0. The flaw exists in the GoodsDaoImpl function within the file src/main/java/com/liujian/gymxmjpa/controller/GoodsController.java, where manipulation of the goodsName argument enables SQL injection.
The vulnerability is exploitable remotely over the network with low attack complexity, requiring low privileges (PR:L) and no user interaction. Attackers can achieve limited impacts on confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). It maps to CWE-74 (improper neutralization of special elements) and CWE-89 (SQL injection).
Advisories provide details via GitHub issues in the liujianview/gymxmjpa repository and VulDB entries. The exploit has been publicly disclosed and may be used.
Published on 2025-01-13, this issue highlights risks in unpatched Java-based applications handling user inputs.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection vulnerability in web application controller (GoodsController.java) enables exploitation of public-facing applications (T1190), abuse of server software components like databases (T1505 as per VulDB), and data collection from databases (T1213.006).