CVE-2025-2657
Published: 23 March 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-2657 is a critical SQL injection vulnerability (CWE-74, CWE-89) in projectworlds Apartment Visitors Management System 1.0. The issue resides in an unknown functionality of the file /front.php, where manipulation of the 'rid' argument enables SQL injection. Published on 2025-03-23, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers require only network access and no authentication or user interaction to exploit this vulnerability with low attack complexity. Successful exploitation can result in limited impacts to confidentiality, integrity, and availability, such as unauthorized access to or modification of database information.
Advisories referenced in VulDB entries (ctiid.300673, id.300673, submit.520237) and a GitHub issue (ydnd/cve/issues/5) document the vulnerability details. The exploit has been publicly disclosed and may be used by attackers. No specific patches or mitigations are detailed in the provided references.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in public-facing web application (/front.php) enables exploitation of public-facing application (T1190) and collection of data from databases via unauthorized SQL query manipulation (T1213.006).