CVE-2025-0490
Published: 15 January 2025
Description
A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0. This issue affects some unknown processing of the file /fladmin/article_dodel.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2025-0490 is a critical SQL injection vulnerability (CWE-74, CWE-89) in Fanli2012 native-php-cms version 1.0. The flaw affects the unknown processing logic in the file /fladmin/article_dodel.php, where manipulation of the 'id' argument enables SQL injection. Published on 2025-01-15, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability is remotely exploitable over the network with low attack complexity and requires low privileges. An attacker can initiate the exploit by manipulating the 'id' parameter, potentially achieving low impacts on confidentiality (e.g., limited data exposure), integrity (e.g., minor unauthorized modifications), and availability (e.g., limited denial of service).
Advisories referenced in GitHub issues (https://github.com/Fanli2012/native-php-cms/issues/12 and related comments) and VulDB entries (https://vuldb.com/?ctiid.291935, https://vuldb.com/?id.291935, https://vuldb.com/?submit.475258) detail the issue, with the exploit disclosed publicly and available for use. No specific patches or mitigations are outlined in the provided references.
Details
- CWE(s)