CVE-2025-0334
Published: 09 January 2025
Summary
CVE-2025-0334 is a medium-severity Injection (CWE-74) vulnerability in Leiyuxi Cy-Fast. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-0334 is a SQL injection vulnerability affecting leiyuxi cy-fast version 1.0. The issue resides in the listData function within the /sys/user/listData file, where manipulation of the 'order' argument enables injection. Classified as critical, it falls under CWE-74 and CWE-89, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by an authenticated attacker with low privileges (PR:L), requiring no user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption via injected SQL commands, depending on the attacker's privileges and database configuration.
Advisories from VulDB (ctiid.290821, id.290821, submit.475302) document the issue, and a proof-of-concept exploit is publicly disclosed on GitHub at d3do-23/cvelist/blob/main/cy-fast/sqli2.md, highlighting the need for immediate patching or input validation on the affected endpoint.
The exploit has been publicly released, increasing the risk of active exploitation against unpatched instances of cy-fast 1.0.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1608
Vulnerability details
A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /sys/user/listData. The manipulation of the argument order leads to sql injection. The attack can be launched…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web app endpoint (/sys/user/listData) directly enables remote exploitation of a public-facing application for data access/modification.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing the 'order' argument in the listData function before database processing.
Mandates timely patching or code remediation of the specific SQL injection flaw in cy-fast 1.0.
Requires vulnerability scanning to identify exposed cy-fast 1.0 instances vulnerable to the disclosed SQL injection exploit.