Cyber Posture

CVE-2025-2385

HighPublic PoC

Published: 17 March 2025

Published
17 March 2025
Modified
07 April 2025
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0012 30.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-2385 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, affecting unknown code within the /login.php file. The issue arises from improper handling of the userEmail and userPassword arguments, allowing manipulation that leads to SQL injection as classified under CWE-74 and CWE-89. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-17.

The vulnerability enables remote exploitation without authentication or user interaction. Attackers can initiate the attack over the network by submitting crafted inputs to the affected parameters during login attempts, potentially resulting in limited impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service.

Advisories referenced in VulDB entries (ctiid.299884, id.299884, submit.516544) and a GitHub issue at MiniSweetBeen/src/issues/2 detail the vulnerability, while the code-projects.org page hosts the affected software. No specific patches or mitigation steps are outlined in the provided description, so practitioners should review these sources for updates or workarounds.

The exploit has been publicly disclosed and may be actively used, increasing the urgency for affected systems running Modern Bag 1.0 to be assessed and remediated.

Details

CWE(s)
CWE-74CWE-89

Affected Products

code-projects
modern bag
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing /login.php enables exploitation of public-facing application (T1190) for unauthenticated remote access and facilitates collection of data from databases via arbitrary SQL queries (T1213.006).

References