CVE-2025-2062
Published: 07 March 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-2062 is a critical SQL injection vulnerability (CWE-74, CWE-89) in projectworlds Life Insurance Management System 1.0. The flaw resides in an unknown function within the file /clientStatus.php, where manipulation of the client_id argument enables SQL code injection. Published on 2025-03-07, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers can exploit this vulnerability without authentication or user interaction, requiring only low attack complexity over the network. Successful exploitation grants low-level impacts on confidentiality, integrity, and availability, allowing potential unauthorized access, modification, or disruption of database operations via injected SQL payloads.
Advisories referenced in VulDB entries (ctiid.298818, id.298818, submit.514722) and a GitHub issue (akjedfha/cve/issues/1) confirm the remote exploitability, with the proof-of-concept already disclosed publicly for potential use. No specific patches or mitigation steps are outlined in the provided details.
The public disclosure of the exploit heightens the urgency for organizations using this system to review and secure exposed instances of /clientStatus.php.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The unauthenticated SQL injection vulnerability in the public-facing /clientStatus.php enables remote exploitation of a public-facing application (T1190) and facilitates arbitrary database queries for data collection from databases (T1213.006), as demonstrated by the time-based blind SQLi POC for database enumeration.