CVE-2025-2351
Published: 16 March 2025
Summary
CVE-2025-2351 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2351 is a SQL injection vulnerability classified as critical in DayCloud StudentManage 1.0. It affects unknown code within the /admin/adminScoreUrl file of the Login Endpoint component, where manipulation of the "query" argument enables the injection. The issue, linked to CWE-74 and CWE-89, carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-16.
The vulnerability is remotely exploitable by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption via injected SQL queries.
VulDB advisories, referenced at https://vuldb.com/?ctiid.299818, https://vuldb.com/?id.299818, and https://vuldb.com/?submit.512793, confirm the exploit has been publicly disclosed and may be in use. The product employs continuous delivery with rolling releases, providing no specific affected or patched version details; the vendor was notified early but has not responded.
The public disclosure of the exploit increases the risk of active exploitation against unpatched instances of DayCloud StudentManage 1.0.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6657
Vulnerability details
A vulnerability classified as critical was found in DayCloud StudentManage 1.0. This vulnerability affects unknown code of the file /admin/adminScoreUrl of the component Login Endpoint. The manipulation of the argument query leads to sql injection. The attack can be initiated…
more
remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote unauthenticated SQL injection in a public-facing web application (Login Endpoint) directly enables T1190 Exploit Public-Facing Application, allowing attackers to inject and execute arbitrary SQL queries for data access, modification, or disruption.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing untrusted inputs such as the 'query' argument in the /admin/adminScoreUrl login endpoint.
Requires timely remediation of the specific SQL injection flaw in DayCloud StudentManage 1.0 to eliminate the vulnerability.
Provides vulnerability scanning to identify and prioritize SQL injection issues like CVE-2025-2351 in the application.