CVE-2025-2064
Published: 07 March 2025
Summary
CVE-2025-2064 is a high-severity Injection (CWE-74) vulnerability in Projectworlds Life Insurance Management System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection attacks by requiring validation and corrective action on untrusted inputs like the recipt_no parameter in /deletePayment.php.
Mandates timely remediation of the critical SQL injection flaw identified in CVE-2025-2064 within the Life Insurance Management System.
Supports proactive detection of SQL injection vulnerabilities like CVE-2025-2064 through regular monitoring and scanning of web applications.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing /deletePayment.php enables initial access via exploitation of public-facing application (T1190), server software component abuse (T1505 as cited in advisory), and data collection from databases (T1213.006) through query manipulation, enumeration, leakage, and tampering.
NVD Description
A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0. Affected by this issue is some unknown functionality of the file /deletePayment.php. The manipulation of the argument recipt_no leads to sql injection. The…
more
attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2064 is a critical SQL injection vulnerability (CWE-74, CWE-89) in projectworlds Life Insurance Management System 1.0. The flaw resides in an unknown functionality of the /deletePayment.php file, where manipulation of the recipt_no argument triggers the injection. Published on 2025-03-07, it carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, potentially allowing unauthorized SQL query execution.
Advisories and further details are documented on VulDB (https://vuldb.com/?ctiid.298820, https://vuldb.com/?id.298820, https://vuldb.com/?submit.514751) and a GitHub issue (https://github.com/ubfbuz3/cve/issues/6). The exploit has been publicly disclosed and may be used.
Details
- CWE(s)