CVE-2025-2112
Published: 08 March 2025
Summary
CVE-2025-2112 is a medium-severity Injection (CWE-74) vulnerability in User-Xiangpeng Yaoqishan. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2112 is a critical SQL injection vulnerability in the yaoqishan project developed by user xiangpeng, affecting versions up to commit a47fec4a31cbd13698c592dfdc938c8824dd25e4. The issue resides in the getMediaLisByFilter function within the file cn/javaex/yaoqishan/service/media_info/MediaInfoService.java, where manipulation of the typeId argument enables SQL injection. This Java-based component is part of a project using rolling releases, so specific affected and patched version details are unavailable.
The vulnerability can be exploited remotely by attackers with low privileges (PR:L), requiring no user interaction and low attack complexity (AC:L). Successful exploitation allows limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), as scored at CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). It is associated with CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection).
Advisories from VulDB and a GitHub repository detail the vulnerability, including a publicly disclosed exploit in yaoqishan-sql.md. The vendor was contacted early but provided no response, and no patches or mitigations are specified due to the rolling release model. Security practitioners should review and sanitize inputs to the affected function or isolate the component.
The exploit has been publicly disclosed and may be in use, with references available on GitHub and VulDB for further analysis.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7497
Vulnerability details
A vulnerability was found in user-xiangpeng yaoqishan up to a47fec4a31cbd13698c592dfdc938c8824dd25e4. It has been declared as critical. Affected by this vulnerability is the function getMediaLisByFilter of the file cn/javaex/yaoqishan/service/media_info/MediaInfoService.java. The manipulation of the argument typeId leads to sql injection. The attack…
more
can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote SQL injection in public-facing Java web service (MediaInfoService.getMediaLisByFilter) enables exploitation of public-facing applications (T1190), abuse of server software components (T1505 per VulDB), and data collection from databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of the typeId input to the getMediaLisByFilter function before constructing SQL queries.
Addresses the specific flaw in MediaInfoService.java by identifying, reporting, and correcting the SQL injection vulnerability through code remediation.
Enables vulnerability scanning to identify the SQL injection in getMediaLisByFilter, allowing timely detection and remediation of the publicly disclosed exploit.