CVE-2025-22976
Published: 15 January 2025
Summary
CVE-2025-22976 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-22976 is a SQL injection vulnerability (CWE-89) in dingfanzuCMS version 1.0, specifically affecting the shopId parameter in the checkOrder.php module due to inadequate input filtering. This flaw enables a local attacker with low privileges to inject malicious SQL payloads, potentially leading to arbitrary code execution. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts without affecting availability.
A local attacker who has obtained low-privilege access to the system can exploit this vulnerability by crafting and submitting a malicious shopId value to the checkOrder.php endpoint. Successful exploitation allows the attacker to execute arbitrary SQL queries, which could result in data exfiltration, modification of database contents, or escalation to arbitrary code execution on the underlying server.
For mitigation details, refer to the advisory at https://github.com/xiaosguang/cve/blob/main/dingfanzu/dingfanzu-CMS%20checkOrder.php%20shopId%20SQL-inject.md, published alongside the CVE on 2025-01-15.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3060
Vulnerability details
SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly at the "checkOrder.php" shopId module.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability allows local low-privileged attacker to inject payloads leading to arbitrary code execution and high integrity impact, directly enabling exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validating the shopId input parameter for correctness and malicious content to prevent SQL injection exploitation.
Mandates timely identification, reporting, and correction of the SQL injection flaw in checkOrder.php to eliminate the vulnerability.
Enforces restrictions on shopId inputs such as type, length, and format to block malformed SQL payloads before processing.