CVE-2025-0489
Published: 15 January 2025
Summary
CVE-2025-0489 is a medium-severity Injection (CWE-74) vulnerability in Native-Php-Cms Project Native-Php-Cms. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0489 is a critical SQL injection vulnerability (classified under CWE-74 and CWE-89) in Fanli2012 native-php-cms version 1.0. The issue resides in unknown code within the file /fladmin/friendlink_dodel.php, where manipulation of the "id" argument triggers the injection. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-15.
The vulnerability is remotely exploitable by an attacker possessing low privileges, such as a authenticated user with access to the affected admin functionality. Successful exploitation via the "id" parameter enables SQL injection, potentially allowing limited impacts on confidentiality (C:L), integrity (I:L), and availability (A:L) of the underlying database.
Advisories provide further details through the project's GitHub repository at https://github.com/Fanli2012/native-php-cms/issues/11 (including issue comment https://github.com/Fanli2012/native-php-cms/issues/11#issue-2769999157) and VulDB entries such as https://vuldb.com/?ctiid.291934, https://vuldb.com/?id.291934, and https://vuldb.com/?submit.475256. Security practitioners should review these sources for any patch availability or mitigation recommendations.
The exploit has been publicly disclosed and may be used by attackers, increasing the urgency for affected systems running native-php-cms 1.0.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1712
Vulnerability details
A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0. This vulnerability affects unknown code of the file /fladmin/friendlink_dodel.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been…
more
disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible web CMS admin endpoint directly enables exploitation of a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by validating and sanitizing the manipulated 'id' parameter in friendlink_dodel.php.
SI-2 mitigates the vulnerability through timely flaw remediation, such as applying patches for this specific SQL injection in native-php-cms 1.0.
SI-9 restricts types and characteristics of inputs like the 'id' argument, blocking malicious SQL injection payloads.