CVE-2025-22976

CVE-2025-22976 is a SQL injection vulnerability (CWE-89) in dingfanzuCMS version 1.0, specifically affecting the shopId parameter in the checkOrder.php module due to inadequate input filtering. This flaw enables a local attacker with low privileges to inject malicious SQL payloads, potentially leading to arbitrary code execution. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts without affecting availability.

A local attacker who has obtained low-privilege access to the system can exploit this vulnerability by crafting and submitting a malicious shopId value to the checkOrder.php endpoint. Successful exploitation allows the attacker to execute arbitrary SQL queries, which could result in data exfiltration, modification of database contents, or escalation to arbitrary code execution on the underlying server.

For mitigation details, refer to the advisory at https://github.com/xiaosguang/cve/blob/main/dingfanzu/dingfanzu-CMS%20checkOrder.php%20shopId%20SQL-inject.md, published alongside the CVE on 2025-01-15.