Cyber Posture

CVE-2025-1381

MediumPublic PoC

Published: 17 February 2025

Published
17 February 2025
Modified
11 April 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0003 10.0th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-1381 is a critical SQL injection vulnerability (CWE-74, CWE-89) in code-projects Real Estate Property Management System 1.0. The flaw affects an unknown part of the file /ajax_city.php, where manipulation of the CityName argument enables SQL injection. Published on 2025-02-17, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

An attacker with low privileges can exploit this remotely over the network with low complexity and no user interaction. Successful exploitation allows limited impacts: low-level disclosure of sensitive information (C:L), modification of data (I:L), and denial of service (A:L) through SQL injection.

Advisories and details are documented in references such as VulDB (ctiid.295989, id.295989, submit.502070), code-projects.org, and a GitHub disclosure at Lonpeak/cve/blob/main/upload-1.md. The exploit has been publicly disclosed and may be used by attackers.

Details

CWE(s)
CWE-74CWE-89

Affected Products

code-projects
real estate property management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection (CVE-2025-1381) in public-facing web app (/ajax_city.php) enables T1190 (Exploit Public-Facing Application) and T1505 (Server Software Component). Advisories note unrestricted upload allowing web shell deployment (T1505.003). SQLi facilitates database data exfiltration (T1213.006).

References