CVE-2025-0488
Published: 15 January 2025
Summary
CVE-2025-0488 is a medium-severity Injection (CWE-74) vulnerability in Native-Php-Cms Project Native-Php-Cms. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0488 is a critical SQL injection vulnerability in Fanli2012 native-php-cms version 1.0, affecting an unknown part of the file product_list.php. The issue arises from manipulation of the 'cat' argument and is remotely exploitable. It is associated with CWEs 74 and 89, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation enables low-impact violations of confidentiality, integrity, and availability, potentially allowing unauthorized access or modification of database content via SQL injection.
Advisories and further details are available in referenced sources, including GitHub issues at https://github.com/Fanli2012/native-php-cms/issues/10 and https://github.com/Fanli2012/native-php-cms/issues/10#issue-2769983658, as well as VulDB entries at https://vuldb.com/?ctiid.291933, https://vuldb.com/?id.291933, and https://vuldb.com/?submit.475255.
The exploit has been publicly disclosed and may be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1711
Vulnerability details
A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file product_list.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The…
more
exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web CMS (product_list.php) enables exploitation of public-facing applications (T1190), abuse of server software components (T1505 as noted in advisory), and data collection from databases via arbitrary queries (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly and comprehensively prevents SQL injection by requiring validation and sanitization of untrusted inputs like the 'cat' argument in product_list.php.
Mandates timely remediation of the specific SQL injection flaw in Fanli2012 native-php-cms 1.0 to eliminate the vulnerability.
Enables detection of SQL injection vulnerabilities like CVE-2025-0488 through regular vulnerability scanning of the web application.