CVE-2025-3038
Published: 31 March 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-3038 is a critical SQL injection vulnerability in code-projects Payroll Management System 1.0, affecting the processing of the /view_account.php file. The issue arises from improper handling of the salary_rate argument, allowing manipulation that leads to SQL injection (CWE-74, CWE-89). It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-31.
The vulnerability can be exploited remotely by an attacker with low privileges, requiring low complexity and no user interaction. Successful exploitation enables limited impacts on confidentiality, integrity, and availability through SQL injection, potentially allowing unauthorized data access, modification, or disruption within the affected application's database.
Advisories from sources like VulDB (ctiid.302099, id.302099) and a GitHub repository document the issue, noting that the exploit has been publicly disclosed and may be used. No specific patches or mitigations are detailed in the available references; security practitioners should monitor the vendor site at code-projects.org for updates and apply input validation or parameterized queries to /view_account.php as interim defenses.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in public-facing web application (/view_account.php) enables initial access via exploitation of public-facing application (T1190) and facilitates unauthorized data collection from backend databases (T1213.006).