Cyber Posture

CVE-2025-0847

HighPublic PoC

Published: 30 January 2025

Published
30 January 2025
Modified
04 February 2025
KEV Added
—
Patch
—
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0004 13.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-0847 is a critical SQL injection vulnerability (CWE-74, CWE-89) in the 1000 Projects Employee Task Management System version 1.0. The flaw affects unknown code in the /index.php file of the Login component, where manipulation of the email argument enables the injection.

The vulnerability is remotely exploitable by unauthenticated attackers requiring low attack complexity and no user interaction, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Exploitation can result in limited impacts to confidentiality, integrity, and availability.

Advisories and related details are available via VulDB entries (ctiid.294010, id.294010, submit.485762), a GitHub issue at github.com/onupset/CVE/issues/5, and the vendor site at 1000projects.org.

The exploit has been publicly disclosed and may be used.

Details

CWE(s)
CWE-74CWE-89

Affected Products

1000projects
employee task management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in unauthenticated login endpoint of public-facing PHP/MySQL web app enables exploitation of public-facing application (T1190) and data collection from databases via query manipulation (T1213.006).

References