CVE-2025-1875

CVE-2025-1875 is a SQL injection vulnerability (CWE-89) discovered in the 101news application, affecting version 1.0. The flaw exists in the "searchtitle" parameter within the search.php file, allowing malicious SQL queries to be injected. Published on March 3, 2025, it carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility, low attack complexity, lack of required privileges or user interaction, and unchanged scope with high impacts on confidentiality, integrity, and availability.

Remote attackers require no authentication or privileges (PR:N) to exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables arbitrary SQL command execution, potentially leading to unauthorized data access, modification, deletion, or denial of service, as indicated by the high impact ratings across confidentiality (C:H), integrity (I:H), and availability (A:H).

The INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-101news) details this issue among multiple vulnerabilities in 101news, recommending mitigation through patching or upgrading to a fixed version where available, input validation, and parameterized queries to prevent SQL injection.