CVE-2025-1184
Published: 12 February 2025
Summary
CVE-2025-1184 is a medium-severity Injection (CWE-74) vulnerability in Pihome Maxair. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1184 is a critical SQL injection vulnerability (CWE-74, CWE-89) in pihome-shc PiHome version 1.77. The flaw resides in unknown functionality of the file /ajax.php?Ajax=GetModal_MQTTEdit, where manipulation of the "id" argument triggers the injection. Published on 2025-02-12, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability enables remote exploitation by attackers possessing low privileges. Exploitation requires network access and low complexity with no user interaction needed, resulting in limited impacts: low confidentiality (e.g., partial data exposure), low integrity (e.g., minor unauthorized modifications), and low availability (e.g., minor denial of service).
Advisories reference a public proof-of-concept exploit at https://github.com/janssensjelle/published-pocs/blob/main/pihome_sqli_ajax.md, along with VulDB entries at https://vuldb.com/?ctiid.295088, https://vuldb.com/?id.295088, and https://vuldb.com/?submit.495413. No specific patches or mitigation steps are detailed in the provided references.
The exploit has been disclosed publicly and may be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2058
Vulnerability details
A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax=GetModal_MQTTEdit. The manipulation of the argument id leads to sql injection. The attack may be launched remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated SQL injection vulnerability in the public-facing web application's ajax.php endpoint enables exploitation of public-facing applications (T1190) and collection of data from the backend database (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation and patching of the specific SQL injection flaw in /ajax.php?Ajax=GetModal_MQTTEdit exploited via the 'id' parameter.
Implements input validation at entry points to sanitize and validate the 'id' argument, comprehensively preventing SQL injection manipulation.
Enables vulnerability scanning to identify and prioritize the SQL injection vulnerability in PiHome 1.77 for remediation before exploitation.