CVE-2025-0410
Published: 13 January 2025
Description
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
Security Summary
CVE-2025-0410 is a critical vulnerability classified in liujianview gymxmjpa version 1.0. It affects the MenberDaoInpl function in the file src/main/java/com/liujian/gymxmjpa/controller/MenberConntroller.java, where manipulation of the hyname argument enables SQL injection. The issue falls under CWE-74 and CWE-89.
The vulnerability allows remote exploitation with low attack complexity and requires low privileges (PR:L), with no user interaction needed. Per the CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), attackers can achieve low impacts on confidentiality, integrity, and availability through SQL injection.
Advisories reference GitHub issues at https://github.com/liujianview/gymxmjpa/issues/10 and https://github.com/liujianview/gymxmjpa/issues/10#issue-2765824571, along with VulDB entries including https://vuldb.com/?ctiid.291286, https://vuldb.com/?id.291286, and https://vuldb.com/?submit.473426. The exploit has been publicly disclosed and may be used.
The vulnerability was published on 2025-01-13, with the exploit already available to the public.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in web application controller enables remote exploitation of public-facing application (T1190), abuse of server software component via arbitrary SQL execution (T1505), and collection of data from databases (T1213.006).