CVE-2025-2036
Published: 06 March 2025
Summary
CVE-2025-2036 is a medium-severity Injection (CWE-74) vulnerability in S-A-Zhd Ecommerce-Website-Using-Php. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2036 is a critical SQL injection vulnerability (CWE-74, CWE-89) affecting s-a-zhd Ecommerce-Website-using-PHP version 1.0. The flaw exists in an unknown part of the file details.php, where manipulation of the pro_id argument enables SQL code injection. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-06.
The vulnerability is exploitable remotely by attackers possessing low privileges, such as authenticated users, with low attack complexity and no requirement for user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability through SQL injection, potentially enabling unauthorized data access, modification, or disruption within the affected application.
Advisories referenced on VulDB (ctiid.298779, id.298779, submit.512405) and WebSecurityInsights detail the vulnerability and confirm that the exploit has been disclosed publicly, making it available for potential use by attackers. No specific patches or mitigations are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7471
Vulnerability details
A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0. It has been classified as critical. This affects an unknown part of the file details.php. The manipulation of the argument pro_id leads to sql injection. It is possible to initiate the attack…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing PHP web app (details.php) directly enables remote exploitation of the application via T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates and sanitizes the pro_id input parameter in details.php to block SQL injection manipulation.
Requires identification, prioritization, testing, and installation of fixes for the SQL injection flaw in Ecommerce-Website-using-PHP 1.0.
Monitors system activity to detect exploitation attempts via anomalous SQL queries triggered by pro_id manipulation.