Cyber Posture

CVE-2025-1843

MediumPublic PoC

Published: 03 March 2025

Published
03 March 2025
Modified
02 September 2025
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 18.6th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1843 is a medium-severity Injection (CWE-74) vulnerability in Project Team Tmall Demo. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mandates validation of untrusted inputs like the orderBy argument to block SQL injection payloads in ProductMapper.java.

prevent

Enforces restrictions on information inputs such as limiting orderBy to whitelisted values, preventing malicious SQL injection exploitation.

preventrecover

Requires identification, prioritization, and remediation of flaws like this SQL injection vulnerability through patching or code hardening.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
Why these techniques?

Unauthenticated SQL injection in public-facing web application (Mini-Tmall ProductMapper.java orderBy parameter) enables exploitation of public-facing application (T1190). VulDB explicitly maps to server software component abuse (T1505).

NVD Description

A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall/dao/ProductMapper.java. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated…

more

remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2025-1843 is a SQL injection vulnerability (CWE-74, CWE-89) in Mini-Tmall versions up to 20250211. The issue affects the select function in the file com/xq/tmall/dao/ProductMapper.java, where manipulation of the orderBy argument enables SQL injection. Published on 2025-03-03, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), though described as critical in initial reports.

The vulnerability allows remote exploitation by low-privileged users (PR:L) with low attack complexity and no user interaction required. Successful exploitation can result in limited impacts to confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption via injected SQL payloads.

VulDB advisories (ctiid.298109, id.298109) and related submissions document the issue, with a public proof-of-concept exploit disclosed on GitHub (qkdjksfkeg/cve_article/Tmall_demo/SQL%20injection.md). The vendor was contacted early but provided no response, and no patches or official mitigations are referenced.

The exploit has been publicly disclosed and may be used in attacks, increasing risk for unpatched Mini-Tmall deployments.

Details

CWE(s)

Affected Products

project team
tmall demo
≤ 2025-02-11

CVEs Like This One

CVE-2025-2927Shared CWE-74, CWE-89
CVE-2025-3039Shared CWE-74, CWE-89
CVE-2025-0843Shared CWE-74, CWE-89
CVE-2025-7180Shared CWE-74, CWE-89
CVE-2025-10090Shared CWE-74, CWE-89
CVE-2025-7165Shared CWE-74, CWE-89
CVE-2025-2382Shared CWE-74, CWE-89
CVE-2025-1841Shared CWE-74, CWE-89
CVE-2025-2675Shared CWE-74, CWE-89
CVE-2025-0232Shared CWE-74, CWE-89

References