Cyber Posture

CVE-2025-0872

MediumPublic PoC

Published: 30 January 2025

Published
30 January 2025
Modified
07 February 2025
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 15.2th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0872 is a medium-severity Injection (CWE-74) vulnerability in Angeljudesuarez Tailoring Management System. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly and comprehensively prevents SQL injection by validating and sanitizing untrusted inputs such as id, amount, desc, and inccat before incorporation into database queries in /addpayment.php.

prevent

Requires timely remediation of the specific SQL injection flaw in Tailoring Management System 1.0 via patches or fixes to eliminate the vulnerability.

prevent

Enforces input restrictions to block invalid or malicious content in parameters like desc, preventing SQL injection exploitation remotely.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Why these techniques?

The SQL injection vulnerability in /addpayment.php enables exploitation of a public-facing web application (T1190), collection of sensitive data from databases via arbitrary queries (T1213.006), tampering with stored database data (T1565.001), and data destruction through SQL commands like DELETE or DROP (T1485).

NVD Description

A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /addpayment.php. The manipulation of the argument id/amount/desc/inccat leads to sql injection. It is possible to launch the attack…

more

remotely. The exploit has been disclosed to the public and may be used.

Deeper analysisAI

CVE-2025-0872 is a critical SQL injection vulnerability (classified under CWE-74 and CWE-89) in itsourcecode Tailoring Management System 1.0. The flaw resides in an unknown function within the file /addpayment.php, where manipulation of the arguments id, amount, desc, and inccat enables SQL injection. The vulnerability was published on 2025-01-30 and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

An attacker with low-privileged user access (PR:L) can exploit this remotely over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service within the application's database.

Advisories from VulDB and a related GitHub issue indicate that an exploit has been publicly disclosed and may be actively used. Practitioners should review the vendor site at itsourcecode.com and VulDB references (ctiid.294066, id.294066, submit.487953) for any updates, though no specific patches are detailed in the available information.

Details

CWE(s)

Affected Products

angeljudesuarez
tailoring management system
1.0

CVEs Like This One

CVE-2025-0946Same product: Angeljudesuarez Tailoring Management System
CVE-2025-0949Same product: Angeljudesuarez Tailoring Management System
CVE-2025-0873Same product: Angeljudesuarez Tailoring Management System
CVE-2025-0944Same product: Angeljudesuarez Tailoring Management System
CVE-2025-0945Same product: Angeljudesuarez Tailoring Management System
CVE-2025-0950Same product: Angeljudesuarez Tailoring Management System
CVE-2025-0943Same product: Angeljudesuarez Tailoring Management System
CVE-2025-0540Same product: Angeljudesuarez Tailoring Management System
CVE-2025-0948Same product: Angeljudesuarez Tailoring Management System
CVE-2025-0947Same product: Angeljudesuarez Tailoring Management System

References