CVE-2025-0533
Published: 17 January 2025
Summary
CVE-2025-0533 is a high-severity Injection (CWE-74) vulnerability in 1000Projects Campaign Management System Platform For Women. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-14 (Public Access Protections) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the 'uname' argument in /Code/sc_login.php.
Mandates protections against known server-side attacks such as SQL injection on public web application endpoints like the vulnerable login functionality.
Requires timely identification, reporting, and correction of the specific SQL injection flaw in CVE-2025-0533.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web login endpoint (/Code/sc_login.php) enables exploitation of public-facing applications (T1190), arbitrary SQL execution via server software component (T1505), and data collection from databases (T1213.006) including enumeration and dumping.
NVD Description
A vulnerability was found in 1000 Projects Campaign Management System Platform for Women 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Code/sc_login.php. The manipulation of the argument uname leads to…
more
sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0533 is a critical SQL injection vulnerability (CWE-74, CWE-89) in the 1000 Projects Campaign Management System Platform for Women version 1.0. The flaw resides in an unknown functionality of the file /Code/sc_login.php, where manipulation of the uname argument triggers the injection. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-17.
The vulnerability enables remote exploitation without authentication or user interaction. Attackers can launch SQL injection attacks over the network with low complexity, potentially compromising low levels of confidentiality, integrity, and availability on affected systems. The exploit has been disclosed publicly and may be actively used.
Advisories provide details via references including the project site at https://1000projects.org/, a GitHub issue at https://github.com/onupset/CVE/issues/2, and VulDB entries at https://vuldb.com/?ctiid.292417, https://vuldb.com/?id.292417, and https://vuldb.com/?submit.479119. No specific patches or mitigations are detailed in the core description.
The public disclosure of the exploit heightens the urgency for users of the affected platform to review these resources for remediation guidance.
Details
- CWE(s)