CVE-2025-0874
Published: 30 January 2025
Summary
CVE-2025-0874 is a medium-severity Injection (CWE-74) vulnerability in Fabian Simple Car Rental System. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the 'id' argument in /admin/approve.php to neutralize SQL injection attempts.
Mandates timely identification, reporting, and correction of the SQL injection flaw in the Car Rental Management software.
Provides vulnerability scanning to identify the SQL injection vulnerability in /admin/approve.php before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the public-facing web application (/admin/approve.php) enables remote exploitation without authentication (T1190) and facilitates unauthorized querying, leakage, modification, or deletion of data from the backend database (T1213.006).
NVD Description
A vulnerability, which was classified as critical, has been found in code-projects Simple Plugins Car Rental Management 1.0. Affected by this issue is some unknown functionality of the file /admin/approve.php. The manipulation of the argument id leads to sql injection.…
more
The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0874 is a SQL injection vulnerability classified as critical in code-projects Simple Plugins Car Rental Management version 1.0. The issue affects unknown functionality within the file /admin/approve.php, where manipulation of the 'id' argument enables the injection. It is associated with CWE-74 (improper neutralization of special elements) and CWE-89 (SQL injection), carrying a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability was published on 2025-01-30.
The attack can be launched remotely by an authenticated user with low privileges (PR:L), requiring no user interaction. Successful exploitation allows an attacker to manipulate the 'id' parameter in /admin/approve.php, potentially leading to unauthorized access, data modification, or disruption with low impacts on confidentiality, integrity, and availability.
Advisories referenced in VulDB entries (ctiid.294068, id.294068, submit.488538) and a GitHub issue document the vulnerability, noting that an exploit has been publicly disclosed and may be used. Additional context is available from the project site at code-projects.org. No specific patch or mitigation details are outlined in the provided information.
Details
- CWE(s)