Cyber Posture

CVE-2025-2064

HighPublic PoC

Published: 07 March 2025

Published
07 March 2025
Modified
14 May 2025
KEV Added
—
Patch
—
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0007 21.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-2064 is a critical SQL injection vulnerability (CWE-74, CWE-89) in projectworlds Life Insurance Management System 1.0. The flaw resides in an unknown functionality of the /deletePayment.php file, where manipulation of the recipt_no argument triggers the injection. Published on 2025-03-07, it carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, potentially allowing unauthorized SQL query execution.

Advisories and further details are documented on VulDB (https://vuldb.com/?ctiid.298820, https://vuldb.com/?id.298820, https://vuldb.com/?submit.514751) and a GitHub issue (https://github.com/ubfbuz3/cve/issues/6). The exploit has been publicly disclosed and may be used.

Details

CWE(s)
CWE-74CWE-89

Affected Products

projectworlds
life insurance management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing /deletePayment.php enables initial access via exploitation of public-facing application (T1190), server software component abuse (T1505 as cited in advisory), and data collection from databases (T1213.006) through query manipulation, enumeration, leakage, and tampering.

References