CVE-2025-0948
Published: 01 February 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-0948 is a critical SQL injection vulnerability in itsourcecode Tailoring Management System 1.0, affecting an unknown functionality within the incview.php file. The issue arises from improper handling of the 'incid' argument, enabling manipulation that leads to SQL injection (CWE-74, CWE-89). Published on 2025-02-01, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring no user interaction and low complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption via injected SQL payloads. An exploit has been publicly disclosed and may be actively used.
Advisories and references, including those on GitHub (https://github.com/magic2353112890/cve/issues/7), VulDB (https://vuldb.com/?ctiid.294303 and https://vuldb.com/?id.294303), and the vendor site (https://itsourcecode.com/), provide further details but do not specify patches or mitigations in the available information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in public-facing web application (incview.php and others) enables exploitation of public-facing application (T1190) and arbitrary database queries for data collection (T1213.006).