Cyber Posture

CVE-2025-2672

MediumPublic PoC

Published: 23 March 2025

Published
23 March 2025
Modified
14 May 2025
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0008 22.3th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-2672 is a SQL injection vulnerability in code-projects Payroll Management System 1.0, affecting unknown processing in the /add_deductions.php file. The issue stems from manipulation of the "bir" argument, with other parameters potentially affected as well. Rated as critical with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), it maps to CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection). The vulnerability was published on 2025-03-23T23:15:13.847.

A remote attacker with low privileges (PR:L) can exploit this over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables SQL injection, resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) within the unchanged scope (S:U).

Advisories referenced on VulDB (e.g., https://vuldb.com/?ctiid.300689, https://vuldb.com/?id.300689) and a GitHub disclosure (https://github.com/FoLaJJ/cve/blob/main/sqlcve.md) detail the issue, along with the project site (https://code-projects.org/). The exploit has been publicly disclosed and may be used, with no specific patches or mitigations mentioned in the available descriptions.

Details

CWE(s)
CWE-74CWE-89

Affected Products

fabian
payroll management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing web app (/add_deductions.php) enables exploitation of public-facing applications (T1190) and data collection from databases via unrestricted query manipulation (T1213.006).

References