CVE-2025-1578

Published Feb 23, 2025

Last updated a month ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-1578 is a critical vulnerability identified in PHPGurukul Online Shopping Portal version 2.1. The vulnerability stems from improper input sanitization of the "product" argument within the `/search-result.php` file, leading to SQL injection. This allows attackers to remotely inject malicious SQL code and potentially compromise the application's confidentiality, integrity, and availability. This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')). Exploiting this vulnerability is reportedly easy, and the exploit has been publicly disclosed, increasing the risk of attacks.

Description
A vulnerability, which was classified as critical, was found in PHPGurukul Online Shopping Portal 2.1. This affects an unknown part of the file /search-result.php. The manipulation of the argument product leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Source
cna@vuldb.com
NVD status
Analyzed

Risk scores

CVSS 4.0

Type
Secondary
Base score
5.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
MEDIUM

CVSS 3.1

Type
Primary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity
HIGH

CVSS 2.0

Type
Secondary
Base score
6.5
Impact score
6.4
Exploitability score
8
Vector string
AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

cna@vuldb.com
CWE-74
nvd@nist.gov
CWE-89

Social media

Hype score
Not currently trending

Configurations