CVE-2025-1216
Published: 12 February 2025
Summary
CVE-2025-1216 is a medium-severity Injection (CWE-74) vulnerability in R1Bbit Yimioa. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1216 is a critical SQL injection vulnerability affecting ywoa versions up to 2024.07.03. The flaw resides in the selectNoticeList function within the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml, where the 'sort' argument can be manipulated to inject malicious SQL code. Classified under CWE-74 and CWE-89, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-02-12.
The vulnerability enables remote exploitation by an authenticated attacker with low privileges. By crafting a malicious 'sort' parameter, an attacker can execute arbitrary SQL queries, potentially leading to limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service within the affected application's database.
Advisories recommend upgrading to ywoa version 2024.07.04, which addresses the issue. References from VulDB and Gitee indicate the exploit has been publicly disclosed and may be actively used.
The exploit's public availability increases the risk of real-world attacks against unpatched ywoa instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2086
Vulnerability details
A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort leads to sql injection. The attack may be initiated…
more
remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible web application component directly enables exploitation of a public-facing (or network-accessible) app per T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of the untrusted 'sort' parameter before it reaches the selectNoticeList function in OaNoticeMapper.xml.
Mandates timely flaw remediation through patching or upgrading to ywoa version 2024.07.04 to eliminate the SQL injection vulnerability.
Restricts the 'sort' argument to only permitted values, blocking malicious SQL injection payloads in the selectNoticeList query.