CVE-2025-0950

CVE-2025-0950 is a critical SQL injection vulnerability in itsourcecode Tailoring Management System 1.0. The issue resides in the processing of the staffview.php file, where manipulation of the staffid argument enables SQL injection. It is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')). The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-02-01.

The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring network access and low complexity with no user interaction needed. Successful exploitation allows limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially enabling unauthorized data access, modification, or disruption via injected SQL payloads in the staffid parameter.

Advisories referenced in VulDB entries (ctiid.294305 and id.294305) and a GitHub issue detail the vulnerability, noting that an exploit has been publicly disclosed and may be used. No specific patches or mitigation steps from the vendor (itsourcecode.com) are detailed in the available information.

The exploit's public disclosure increases the risk of active exploitation against unpatched Tailoring Management System 1.0 deployments.