Cyber Posture

CVE-2025-2062

HighPublic PoC

Published: 07 March 2025

Published
07 March 2025
Modified
14 May 2025
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 19.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-2062 is a critical SQL injection vulnerability (CWE-74, CWE-89) in projectworlds Life Insurance Management System 1.0. The flaw resides in an unknown function within the file /clientStatus.php, where manipulation of the client_id argument enables SQL code injection. Published on 2025-03-07, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Remote attackers can exploit this vulnerability without authentication or user interaction, requiring only low attack complexity over the network. Successful exploitation grants low-level impacts on confidentiality, integrity, and availability, allowing potential unauthorized access, modification, or disruption of database operations via injected SQL payloads.

Advisories referenced in VulDB entries (ctiid.298818, id.298818, submit.514722) and a GitHub issue (akjedfha/cve/issues/1) confirm the remote exploitability, with the proof-of-concept already disclosed publicly for potential use. No specific patches or mitigation steps are outlined in the provided details.

The public disclosure of the exploit heightens the urgency for organizations using this system to review and secure exposed instances of /clientStatus.php.

Details

CWE(s)
CWE-74CWE-89

Affected Products

projectworlds
life insurance management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

The unauthenticated SQL injection vulnerability in the public-facing /clientStatus.php enables remote exploitation of a public-facing application (T1190) and facilitates arbitrary database queries for data collection from databases (T1213.006), as demonstrated by the time-based blind SQLi POC for database enumeration.

References