CVE-2025-0296
Published: 07 January 2025
Summary
CVE-2025-0296 is a medium-severity Injection (CWE-74) vulnerability in Code-Projects Online Book Shop. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0296 is a critical SQL injection vulnerability (CWE-74, CWE-89) in code-projects Online Book Shop 1.0. The flaw affects an unknown part of the file /booklist.php, where manipulation of the subcatid argument enables SQL injection. Published on 2025-01-07, it carries a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants limited access to confidential data (C:L), allows limited modification of data or processes (I:L), and causes limited denial of service (A:L), all without changing scope.
Advisories from VulDB (ctiid.290445, id.290445, submit.475135) document the issue, while a GitHub gist provides a public proof-of-concept exploit. The project site at code-projects.org is referenced, but no patches or specific mitigations are mentioned in the available details.
The exploit has been disclosed publicly and may be used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1586
Vulnerability details
A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. The manipulation of the argument subcatid leads to sql injection. It is possible to initiate…
more
the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of SQL injection in a public-facing web application (/booklist.php) matches T1190 exactly; limited DB impacts do not reliably enable additional techniques like command execution or specific data staging.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing the subcatid input parameter before it is used in database queries within /booklist.php.
Remediates the specific SQL injection flaw in /booklist.php by identifying, prioritizing, and correcting the vulnerable code.
Boundary protection with web application firewalls or proxies inspects and blocks SQL injection payloads targeting the subcatid parameter remotely.