CVE-2025-2041
Published: 06 March 2025
Summary
CVE-2025-2041 is a medium-severity Injection (CWE-74) vulnerability in S-A-Zhd Ecommerce-Website-Using-Php. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2041 is a critical SQL injection vulnerability in s-a-zhd Ecommerce-Website-using-PHP version 1.0. The issue affects unknown functionality within the /shop.php file, where manipulation of the p_cat argument enables SQL injection. It is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring low attack complexity (AC:L) over the network (AV:N) with no user interaction (UI:N) and no impact on scope (S:U). Successful exploitation allows limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), as scored at CVSS 6.3 (CVSS:3.1). This could enable unauthorized data access, modification, or disruption via injected SQL payloads.
Advisories from VulDB detail the vulnerability, including submission records and a specific entry for the issue, while a blog post on websecurityinsights.my.id provides further analysis of the SQL injection in /shop.php?p_cat. No patches or specific mitigations are detailed in the available references. The exploit has been publicly disclosed and may be used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7476
Vulnerability details
A vulnerability, which was classified as critical, has been found in s-a-zhd Ecommerce-Website-using-PHP 1.0. Affected by this issue is some unknown functionality of the file /shop.php. The manipulation of the argument p_cat leads to sql injection. The attack may be…
more
launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing PHP web app (/shop.php) directly enables exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the p_cat parameter in /shop.php.
Mandates identification, prioritization, and remediation of flaws such as the SQL injection vulnerability in CVE-2025-2041.
Restricts the types and characteristics of inputs like p_cat to authorized values, blocking malicious SQL payloads.