CVE-2025-1812

CVE-2025-1812 is a SQL injection vulnerability affecting the zj1983 zz software up to version 2024-08. The issue resides in the GetUserOrg function within the file com/futvan/z/framework/core/SuperZ.java, where the userId argument can be manipulated to inject malicious SQL payloads. Classified under CWE-74 and CWE-89, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-02.

An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity (AC:L) and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption through injected SQL commands.

Advisories from VulDB and a GitHub issue tracker indicate that the exploit has been publicly disclosed and may be actively used. The vendor was contacted early regarding the issue but provided no response, and no patches or specific mitigations are mentioned in the available references. Security practitioners should review and update affected instances of zj1983 zz where possible, applying input validation or database query parameterization as interim defenses.