CVE-2025-2062
Published: 07 March 2025
Summary
CVE-2025-2062 is a medium-severity Injection (CWE-74) vulnerability in Projectworlds Life Insurance Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2062 is a critical SQL injection vulnerability (CWE-74, CWE-89) in projectworlds Life Insurance Management System 1.0. The flaw resides in an unknown function within the file /clientStatus.php, where manipulation of the client_id argument enables SQL code injection. Published on 2025-03-07, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers can exploit this vulnerability without authentication or user interaction, requiring only low attack complexity over the network. Successful exploitation grants low-level impacts on confidentiality, integrity, and availability, allowing potential unauthorized access, modification, or disruption of database operations via injected SQL payloads.
Advisories referenced in VulDB entries (ctiid.298818, id.298818, submit.514722) and a GitHub issue (akjedfha/cve/issues/1) confirm the remote exploitability, with the proof-of-concept already disclosed publicly for potential use. No specific patches or mitigation steps are outlined in the provided details.
The public disclosure of the exploit heightens the urgency for organizations using this system to review and secure exposed instances of /clientStatus.php.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6236
Vulnerability details
A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Affected is an unknown function of the file /clientStatus.php. The manipulation of the argument client_id leads to sql injection. It is possible to launch the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated SQL injection vulnerability in the public-facing /clientStatus.php enables remote exploitation of a public-facing application (T1190) and facilitates arbitrary database queries for data collection from databases (T1213.006), as demonstrated by the time-based blind SQLi POC for database enumeration.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs such as the client_id parameter to directly prevent SQL injection exploitation.
SI-2 mandates identification, reporting, and correction of system flaws like the SQL injection in /clientStatus.php.
RA-5 provides vulnerability scanning to detect SQL injection flaws in the application during monitoring activities.