CVE-2025-1356
Published: 16 February 2025
Description
A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file card.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Security Summary
CVE-2025-1356 is a SQL injection vulnerability (CWE-74, CWE-89) in the needyamin Library Card System version 1.0. The issue resides in an unknown functionality of the file card.php, where manipulation of the 'id' argument triggers the injection. Published on 2025-02-16, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and has been rated as critical.
The vulnerability enables remote exploitation by an attacker possessing low privileges, such as an authenticated user, with low complexity and no requirement for user interaction. Successful attacks can result in limited impacts: partial disclosure of sensitive data (low confidentiality), minor modification of data or behavior (low integrity), and limited denial of service (low availability).
Advisories from VulDB indicate that the vendor was contacted early regarding the disclosure but provided no response. No patches or specific mitigations are detailed in available references, which include VulDB entries (ctiid.295964, id.295964, submit.496087) and a Web Security Insights page.
The exploit has been publicly disclosed and may be used by attackers.
Details
- CWE(s)