CVE-2025-1874
Published: 03 March 2025
Summary
CVE-2025-1874 is a critical-severity SQL Injection (CWE-89) vulnerability in Mayurik Best Online News Portal. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by enforcing validation and sanitization of the untrusted 'description' parameter in admin/add-category.php before SQL query construction.
Requires timely identification, reporting, and patching of the specific SQL injection flaw in the 101news application.
Enforces restrictions on input types, quantities, patterns, or content to block common SQL injection payloads targeting the 'description' parameter.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated SQL injection in a web application component maps cleanly to exploitation of a public-facing app.
NVD Description
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "description" parameter in admin/add-category.php.
Deeper analysisAI
CVE-2025-1874 is a SQL injection vulnerability (CWE-89) discovered in the 101news application, affecting version 1.0 through the "description" parameter in the admin/add-category.php component. Published on 2025-03-03, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation grants high-impact access to confidentiality, integrity, and availability, enabling arbitrary SQL query execution that could result in data exfiltration, modification, or deletion.
The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-101news covers this issue among multiple vulnerabilities in 101news and provides related guidance for practitioners.
Details
- CWE(s)