CVE-2025-0490
Published: 15 January 2025
Summary
CVE-2025-0490 is a medium-severity Injection (CWE-74) vulnerability in Native-Php-Cms Project Native-Php-Cms. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0490 is a critical SQL injection vulnerability (CWE-74, CWE-89) in Fanli2012 native-php-cms version 1.0. The flaw affects the unknown processing logic in the file /fladmin/article_dodel.php, where manipulation of the 'id' argument enables SQL injection. Published on 2025-01-15, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability is remotely exploitable over the network with low attack complexity and requires low privileges. An attacker can initiate the exploit by manipulating the 'id' parameter, potentially achieving low impacts on confidentiality (e.g., limited data exposure), integrity (e.g., minor unauthorized modifications), and availability (e.g., limited denial of service).
Advisories referenced in GitHub issues (https://github.com/Fanli2012/native-php-cms/issues/12 and related comments) and VulDB entries (https://vuldb.com/?ctiid.291935, https://vuldb.com/?id.291935, https://vuldb.com/?submit.475258) detail the issue, with the exploit disclosed publicly and available for use. No specific patches or mitigations are outlined in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1713
Vulnerability details
A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0. This issue affects some unknown processing of the file /fladmin/article_dodel.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote SQL injection in a web-facing CMS component (publicly exploitable over network with low privileges) maps to initial access via public application exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validating and sanitizing information inputs such as the 'id' parameter to directly prevent SQL injection exploitation in /fladmin/article_dodel.php.
SI-2 ensures timely remediation of identified flaws like the SQL injection vulnerability in Fanli2012 native-php-cms 1.0.
RA-5 involves scanning for vulnerabilities such as the SQL injection in /fladmin/article_dodel.php to identify and prioritize remediation.