Cyber Posture

CVE-2025-2044

MediumPublic PoC

Published: 06 March 2025

Published
06 March 2025
Modified
13 May 2025
KEV Added
—
Patch
—
CVSS Score 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 18.3th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-2044 is a SQL injection vulnerability (CWE-74, CWE-89) in code-projects Blood Bank Management System 1.0. The issue affects an unknown functionality in the file /admin/delete_bloodGroup.php, where manipulation of the blood_id argument enables injection. It has been rated critical despite a CVSS 3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-06.

The vulnerability is remotely exploitable over the network with low complexity and no user interaction required, though it demands high privileges (PR:H). An attacker with such access can achieve low impacts on confidentiality, integrity, and availability through SQL injection.

Advisories and details appear on VulDB entries (ctiid.298789, id.298789, submit.513653), with a public exploit disclosed on GitHub at intercpt/XSS1/blob/main/SQL5.md. The project page is hosted at code-projects.org. No patch or mitigation details are specified in the CVE description.

The exploit has been disclosed to the public and may be used.

Details

CWE(s)
CWE-74CWE-89

Affected Products

code-projects
blood bank management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web app (/admin/delete_bloodGroup.php) enables exploitation of public-facing applications (T1190), abuse of server software components (T1505 per VulDB), and data collection from databases (T1213.006).

References