Cyber Posture

CVE-2025-1596

HighPublic PoC

Published: 23 February 2025

Published
23 February 2025
Modified
28 February 2025
KEV Added
—
Patch
—
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0018 39.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-1596 is a critical SQL injection vulnerability (classified under CWE-74 and CWE-89) in SourceCodester Best Church Management Software version 1.0. The issue resides in the processing of the file /fpassword.php, where manipulation of the "email" argument enables SQL injection.

The vulnerability is remotely exploitable by unauthenticated attackers requiring low complexity and no user interaction, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Exploitation can result in low-level impacts to confidentiality, integrity, and availability.

VulDB advisories (ctiid.296591, id.296591, submit.497868) and a GitHub disclosure detail the SQL injection proof-of-concept, which has been made public. The vendor was notified early but provided no response, and no patches or official mitigations are referenced. The software's SourceCodester page offers no further details on remediation.

Details

CWE(s)
CWE-74CWE-89

Affected Products

mayurik
best church management software
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

Unauthenticated remote SQL injection in public-facing web application (/fpassword.php) enables exploitation of public-facing applications (T1190), abuse of server software components (T1505), and collection from databases (T1213.006).

References