CVE-2025-1162
Published: 10 February 2025
Summary
CVE-2025-1162 is a medium-severity Injection (CWE-74) vulnerability in Anisha Job Recruitment. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1162 is a critical SQL injection vulnerability (CWE-74, CWE-89) in code-projects Job Recruitment 1.0, published on 2025-02-10. It affects an unknown part of the file /_parse/load_user-profile.php, where manipulation of the userhash argument enables the injection. The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
An attacker with low privileges can exploit this remotely by manipulating the userhash parameter, leading to SQL injection. Successful exploitation may result in low-level impacts to confidentiality, integrity, and availability, as indicated by the CVSS vector.
Advisories and related details are available via VulDB entries (https://vuldb.com/?ctiid.295065, https://vuldb.com/?id.295065, https://vuldb.com/?submit.494007), the project site (https://code-projects.org/), and a publicly disclosed exploit in https://github.com/J0hnFFFF/j0hn_upload_two/blob/main/web1.pdf. No specific patches or mitigations are detailed in the provided information.
The exploit has been disclosed to the public and may be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2036
Vulnerability details
A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_parse/load\_user-profile.php. The manipulation of the argument userhash leads to sql injection. It is possible to initiate the attack remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of a web application SQL injection flaw matches T1190 (Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation of the userhash parameter against defined content requirements to block malicious inputs.
SI-2 mandates timely identification, reporting, and remediation of the specific SQL injection flaw in /_parse/load_user-profile.php.
SC-7 enforces boundary protection that can block or detect SQL injection attempts on the userhash parameter via web application firewalls or proxies.