CVE-2025-2951

CVE-2025-2951 is a critical SQL injection vulnerability in Bluestar Micro Mall 1.0, affecting an unknown function within the file /api/data.php. The issue arises from improper handling of the 'Search' argument, allowing manipulation that leads to SQL injection as classified under CWE-74 and CWE-89. Published on 2025-03-30, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating network-accessible exploitation with low complexity and requiring low privileges.

Attackers can exploit this vulnerability remotely by manipulating the 'Search' parameter in requests to /api/data.php. Exploitation requires low privileges (PR:L), such as those of an authenticated user, and no user interaction. Successful attacks enable limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially allowing unauthorized data access, modification, or disruption via injected SQL payloads.

Advisories from VulDB detail the vulnerability, including submission records and exploit disclosure, available at references such as https://vuldb.com/?ctiid.302004, https://vuldb.com/?id.302004, and https://vuldb.com/?submit.521162, along with analysis on Jianshu at https://www.jianshu.com/p/22d3ae38e628. The exploit has been publicly disclosed and may be used by attackers.

In notable context, the public availability of the exploit increases the risk of active exploitation against unpatched Bluestar Micro Mall 1.0 instances.