CVE-2025-1356
Published: 16 February 2025
Summary
CVE-2025-1356 is a medium-severity Injection (CWE-74) vulnerability in Needyamin Library Card System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1356 is a SQL injection vulnerability (CWE-74, CWE-89) in the needyamin Library Card System version 1.0. The issue resides in an unknown functionality of the file card.php, where manipulation of the 'id' argument triggers the injection. Published on 2025-02-16, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and has been rated as critical.
The vulnerability enables remote exploitation by an attacker possessing low privileges, such as an authenticated user, with low complexity and no requirement for user interaction. Successful attacks can result in limited impacts: partial disclosure of sensitive data (low confidentiality), minor modification of data or behavior (low integrity), and limited denial of service (low availability).
Advisories from VulDB indicate that the vendor was contacted early regarding the disclosure but provided no response. No patches or specific mitigations are detailed in available references, which include VulDB entries (ctiid.295964, id.295964, submit.496087) and a Web Security Insights page.
The exploit has been publicly disclosed and may be used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2117
Vulnerability details
A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file card.php. The manipulation of the argument id leads to sql injection. The attack…
more
may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible web application (card.php) directly enables exploitation of a public-facing app for data access/modification.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted inputs like the 'id' argument in card.php to block SQL injection manipulation.
Mandates timely remediation of identified flaws such as the SQL injection vulnerability in CVE-2025-1356.
Enables vulnerability scanning to identify SQL injection issues like this one in the Library Card System before exploitation.