Cyber Posture

CVE-2025-2037

MediumPublic PoC

Published: 06 March 2025

Published
06 March 2025
Modified
13 May 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 18.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-2037 is a SQL injection vulnerability affecting code-projects Blood Bank Management System 1.0. The flaw exists in unknown code within the file /user_dashboard/delete_requester.php, where manipulation of the requester_id argument enables SQL injection. Published on 2025-03-06, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and maps to CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).

The vulnerability allows remote exploitation by low-privileged users over the network with low attack complexity and no user interaction. Successful exploitation enables limited impacts, including unauthorized low-level access to data (confidentiality), modification of data (integrity), and disruption of service (availability).

Advisories and details are documented on VulDB (https://vuldb.com/?ctiid.298780, https://vuldb.com/?id.298780, https://vuldb.com/?submit.512550), with the original project at https://code-projects.org/. A public exploit is available at https://github.com/intercpt/XSS1/blob/main/SQL1.md and may be used by attackers.

Details

CWE(s)
CWE-74CWE-89

Affected Products

code-projects
blood bank management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web application (/user_dashboard/delete_requester.php) enables exploitation of public-facing applications (T1190), abuse of server software components like databases (T1505), and data collection from databases (T1213.006).

References