CVE-2025-0300
Published: 07 January 2025
Summary
CVE-2025-0300 is a medium-severity Injection (CWE-74) vulnerability in Fabian Online Book Shop. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 enforces input validation at entry points, directly preventing SQL injection via the unsanitized 'cat' parameter in /subcat.php.
SI-2 requires timely identification, reporting, and correction of flaws like the SQL injection vulnerability in the Online Book Shop application.
SC-7 implements boundary protection such as web application firewalls to block SQL injection exploits targeting the 'cat' parameter remotely.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a public-facing web application (/subcat.php) directly enables remote exploitation of the app for data access/modification.
NVD Description
A vulnerability classified as critical was found in code-projects Online Book Shop 1.0. Affected by this vulnerability is an unknown functionality of the file /subcat.php. The manipulation of the argument cat leads to sql injection. The attack can be launched…
more
remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0300 is a critical SQL injection vulnerability (CWE-74, CWE-89) affecting code-projects Online Book Shop 1.0. The issue resides in an unknown functionality of the /subcat.php file, where manipulation of the 'cat' argument enables SQL injection. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-07T17:15:32.090.
The vulnerability allows remote exploitation by an attacker possessing low privileges. By injecting malicious SQL via the 'cat' parameter, an attacker can achieve limited impacts, including partial unauthorized disclosure of sensitive data (low confidentiality), limited modification of data or configuration (low integrity), and limited denial of service (low availability).
Advisories and references are available from VulDB (including ctiid.290449, id.290449, and submit.475286), the project site at code-projects.org, and a public exploit disclosure on GitHub Gist. No specific patches or mitigations are detailed in the provided information.
The exploit has been disclosed to the public and may be used.
Details
- CWE(s)