CVE-2025-2030
Published: 06 March 2025
Summary
CVE-2025-2030 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2030 is a SQL injection vulnerability (CWE-74, CWE-89) in the Seeyon Zhiyuan Interconnect FE Collaborative Office Platform up to version 20250224. The issue affects unknown functionality in the /security/addUser.jsp file, where manipulation of the groupId argument triggers the injection. Published on 2025-03-06, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and has been described as critical.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability with low attack complexity. Successful exploitation enables limited impacts on confidentiality, integrity, and availability through SQL injection, potentially allowing unauthorized data access, modification, or disruption.
Advisories from sources like VulDB and a GitHub repository detail the public disclosure of an exploit, which may be actively used by attackers. The vendor was notified early but provided no response, and no patches or official mitigations are referenced.
The exploit code has been made publicly available, increasing the risk of widespread exploitation in unpatched environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6199
Vulnerability details
A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform up to 20250224. It has been rated as critical. Affected by this issue is some unknown functionality of the file /security/addUser.jsp. The manipulation of the argument groupId leads…
more
to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a public-facing web application (/security/addUser.jsp) with no authentication required directly enables remote exploitation of the server, mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs such as the groupId parameter to reject malicious SQL injection payloads before processing.
SI-2 mandates timely remediation of identified flaws, including patching or hardening against this SQL injection vulnerability in /security/addUser.jsp.
RA-5 uses vulnerability scanning to detect SQL injection issues like CVE-2025-2030 and initiate remediation to prevent exploitation.