CVE-2025-0299
Published: 07 January 2025
Summary
CVE-2025-0299 is a medium-severity Injection (CWE-74) vulnerability in Code-Projects Online Book Shop. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0299 is a critical SQL injection vulnerability in code-projects Online Book Shop 1.0, affecting an unknown function within the /search_result.php file. The issue arises from improper handling of the 's' argument, allowing manipulation that leads to SQL injection. It is remotely exploitable and has been assigned CWE-74 and CWE-89, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Remote attackers with low privileges, such as authenticated users, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts including low-level confidentiality, integrity, and availability violations, potentially allowing unauthorized access, modification, or disruption of database operations depending on the backend configuration.
Advisories and details are documented on VulDB (ctiid.290448, id.290448, submit.475285), with a public proof-of-concept exploit available in a GitHub Gist. The vendor site at code-projects.org provides context on the affected Online Book Shop 1.0 application, though no specific patches or mitigations are detailed in the available information.
The exploit has been publicly disclosed and may be used by attackers targeting unpatched instances of this software.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1589
Vulnerability details
A vulnerability classified as critical has been found in code-projects Online Book Shop 1.0. Affected is an unknown function of the file /search_result.php. The manipulation of the argument s leads to sql injection. It is possible to launch the attack…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote SQL injection in a public-facing web application (/search_result.php) enables initial access via exploitation of the vulnerable endpoint.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the 's' argument in /search_result.php.
Ensures identification, reporting, and timely remediation of the SQL injection flaw in the Online Book Shop application.
Boundary protection mechanisms such as web application firewalls can inspect and block SQL injection attempts targeting the vulnerable /search_result.php endpoint.