CVE-2025-2385
Published: 17 March 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-2385 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, affecting unknown code within the /login.php file. The issue arises from improper handling of the userEmail and userPassword arguments, allowing manipulation that leads to SQL injection as classified under CWE-74 and CWE-89. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-17.
The vulnerability enables remote exploitation without authentication or user interaction. Attackers can initiate the attack over the network by submitting crafted inputs to the affected parameters during login attempts, potentially resulting in limited impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service.
Advisories referenced in VulDB entries (ctiid.299884, id.299884, submit.516544) and a GitHub issue at MiniSweetBeen/src/issues/2 detail the vulnerability, while the code-projects.org page hosts the affected software. No specific patches or mitigation steps are outlined in the provided description, so practitioners should review these sources for updates or workarounds.
The exploit has been publicly disclosed and may be actively used, increasing the urgency for affected systems running Modern Bag 1.0 to be assessed and remediated.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in public-facing /login.php enables exploitation of public-facing application (T1190) for unauthenticated remote access and facilitates collection of data from databases via arbitrary SQL queries (T1213.006).