CVE-2025-1875
Published: 03 March 2025
Summary
CVE-2025-1875 is a critical-severity SQL Injection (CWE-89) vulnerability in Mayurik Best Online News Portal. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1875 is a SQL injection vulnerability (CWE-89) discovered in the 101news application, affecting version 1.0. The flaw exists in the "searchtitle" parameter within the search.php file, allowing malicious SQL queries to be injected. Published on March 3, 2025, it carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility, low attack complexity, lack of required privileges or user interaction, and unchanged scope with high impacts on confidentiality, integrity, and availability.
Remote attackers require no authentication or privileges (PR:N) to exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables arbitrary SQL command execution, potentially leading to unauthorized data access, modification, deletion, or denial of service, as indicated by the high impact ratings across confidentiality (C:H), integrity (I:H), and availability (A:H).
The INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-101news) details this issue among multiple vulnerabilities in 101news, recommending mitigation through patching or upgrading to a fixed version where available, input validation, and parameterized queries to prevent SQL injection.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5773
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "searchtitle" parameter in search.php.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct network-exploitable SQL injection in a public-facing web application (search.php) enables initial access via T1190 without auth or interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates validation of user inputs like the 'searchtitle' parameter to block malicious SQL injection payloads.
Requires timely patching or upgrading of the vulnerable 101news search.php to remediate the SQL injection flaw.
Restricts the 'searchtitle' parameter to permitted types and formats, limiting opportunities for SQL injection.