CVE-2025-0344
Published: 09 January 2025
Summary
CVE-2025-0344 is a medium-severity Injection (CWE-74) vulnerability in Leiyuxi Cy-Fast. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0344 is a SQL injection vulnerability affecting leiyuxi cy-fast version 1.0. The issue resides in the listData function within the /commpara/listData file, where manipulation of the 'order' argument enables injection. Classified as critical, it corresponds to CWE-74 and CWE-89, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by an authenticated attacker with low privileges (PR:L). Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption through injected SQL payloads.
Advisories from VulDB (ctiid.290857, id.290857, submit.475747) document the issue, while a GitHub repository (d3do-23/cvelist/blob/main/cy-fast/sqli3.md) publicly discloses a proof-of-concept exploit. No specific patches or vendor mitigations are detailed in available references.
The exploit has been publicly disclosed and may be actively used, increasing the risk for deployments of the affected software.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1615
Vulnerability details
A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /commpara/listData. The manipulation of the argument order leads to sql injection. The attack can be launched…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app /commpara/listData enables initial access via exploitation of public-facing application (T1190), abuse of server software component for SQL execution (T1505), and data collection from databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of the untrusted 'order' argument in the listData function before processing in SQL queries.
Requires identification, reporting, and correction of the specific SQL injection flaw in /commpara/listData to eliminate the vulnerability.
Vulnerability scanning detects the SQL injection issue in the affected endpoint, enabling timely remediation.