CVE-2025-0565
Published: 19 January 2025
Summary
CVE-2025-0565 is a medium-severity Injection (CWE-74) vulnerability in Zzcms Zzcms. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-0565 is a SQL injection vulnerability in ZZCMS 2023, rated as critical with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). It affects an unknown functionality in the /index.php file, where manipulation of the 'id' argument enables SQL injection. The vulnerability is linked to CWE-74 (improper neutralization of special elements) and CWE-89 (SQL injection) and was published on 2025-01-19.
Remote attackers without authentication prerequisites can exploit this issue by crafting requests that inject malicious SQL via the 'id' parameter in /index.php. Successful exploitation could result in low impacts to confidentiality (e.g., limited data exposure), integrity (e.g., minor unauthorized modifications), and availability (e.g., slight service disruption), depending on the database privileges and backend configuration.
Advisories from VulDB (ctiid.292526, id.292526, submit.484333) document the vulnerability details, while a GitHub repository (En0t5/vul/blob/main/zzcms/zzcsm-sql-inject.md) provides a publicly disclosed exploit proof-of-concept that may be actively used by attackers.
The public availability of the exploit POC heightens the risk for unpatched ZZCMS 2023 instances exposed to the internet.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1762
Vulnerability details
A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument id leads to sql injection. The attack may be launched…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote SQL injection in unauthenticated public web endpoint (/index.php) matches initial access via public-facing application exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user inputs such as the 'id' parameter in /index.php to neutralize SQL injection attacks.
Mandates timely identification, reporting, and correction of the specific SQL injection flaw in ZZCMS 2023.
Requires vulnerability scanning to detect and prioritize remediation of this publicly disclosed SQL injection vulnerability.