CVE-2025-0208
Published: 04 January 2025
Summary
CVE-2025-0208 is a medium-severity Injection (CWE-74) vulnerability in Code-Projects Online Shoe Store. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0208 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting an unknown functionality within the /summary.php file. The issue arises from improper handling of the 'tid' argument, enabling manipulation that leads to SQL injection as classified under CWE-74 and CWE-89. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on January 4, 2025.
The vulnerability is remotely exploitable over the network with low attack complexity and requires low privileges (PR:L), such as an authenticated user account. Attackers can manipulate the 'tid' parameter to inject malicious SQL payloads, potentially resulting in low-impact confidentiality, integrity, and availability violations, such as unauthorized data access or modification within the application's database.
Advisories from VulDB (ctiid.290145, id.290145, submit.474038) document the vulnerability, while the project site at code-projects.org provides context on the affected software. A proof-of-concept exploit is publicly available on GitHub Gist (th4s1s/24925a20d1f9336858dee1cbbb30c249), increasing the risk of widespread use; no specific patches or mitigations are detailed in the available references.
The exploit disclosure heightens the urgency for users of Online Shoe Store 1.0 to review and harden their deployments against SQL injection, particularly in environments exposing the /summary.php endpoint.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1546
Vulnerability details
A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /summary.php. The manipulation of the argument tid leads to sql injection. It is possible to initiate the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (/summary.php) directly enables remote exploitation of the application per T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the 'tid' argument in /summary.php.
Mandates identification, reporting, and correction of the specific SQL injection flaw in Online Shoe Store 1.0.
Boundary protection mechanisms such as web application firewalls inspect and block SQL injection payloads targeting the /summary.php endpoint.