CVE-2025-25994
Published: 14 February 2025
Description
SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id.
Security Summary
CVE-2025-25994 is an SQL injection vulnerability (CWE-89) in FeMiner wms version 1.0. The issue affects the parameters date1, date2, and id, allowing a remote attacker to obtain sensitive information. Published on 2025-02-14, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact with no requirements for user interaction, privileges, or disruption to integrity or availability.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity. By injecting malicious SQL payloads into the vulnerable parameters, the attacker can execute arbitrary database queries and extract sensitive information stored in the backend database.
Mitigation details are available in the referenced advisory at https://github.com/FeMiner/wms/issues/20.
Details
- CWE(s)