CVE-2025-1871
Published: 03 March 2025
Summary
CVE-2025-1871 is a critical-severity SQL Injection (CWE-89) vulnerability in Mayurik Best Online News Portal. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates and sanitizes the 'category' and 'subcategory' parameters in admin/add-subcategory.php to block SQL injection payloads.
Requires timely remediation of the specific SQL injection flaw in 101news version 1.0 through patching or secure code updates.
Deploys web application firewall at the boundary to inspect and block malicious SQL injection attempts on the vulnerable parameters.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in a public-facing web app (admin/add-subcategory.php) directly enables remote exploitation of the application over the network.
NVD Description
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "category" and "subcategory" parameters in admin/add-subcategory.php.
Deeper analysisAI
CVE-2025-1871 is an SQL injection vulnerability (CWE-89) in the 101news application, affecting version 1.0 through the "category" and "subcategory" parameters in the admin/add-subcategory.php component. Published on 2025-03-03T13:15:12.253, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
Remote unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables high-impact compromise of confidentiality, integrity, and availability, typically allowing arbitrary SQL command injection to read sensitive data, modify records, or disrupt database operations.
The INCIBE-CERT advisory provides further details on this and other vulnerabilities in 101news at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-101news.
Details
- CWE(s)