CVE-2025-2353
Published: 17 March 2025
Summary
CVE-2025-2353 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2353 is a critical SQL injection vulnerability affecting VAM Virtual Airlines Manager versions up to 2.6.2. The issue resides in an unknown function within the file /vam/index.php, specifically the HTTP GET Parameter Handler component. Attackers can exploit it by manipulating the arguments ID, registry_id, or plane_icao, with other parameters potentially vulnerable as well. The vulnerability was published on 2025-03-17 and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), associated with CWE-74 and CWE-89.
The vulnerability enables remote exploitation without authentication or user interaction. Unauthenticated attackers can send crafted HTTP GET requests to the affected endpoint, injecting malicious SQL payloads to potentially read sensitive data, modify database contents, or disrupt service availability, albeit with low impact levels across confidentiality, integrity, and availability as per the CVSS score.
VulDB advisories, which serve as the primary references for this CVE, indicate that the exploit has been publicly disclosed and may be actively used. The vendor was contacted early regarding the issue but provided no response, and no patches or mitigations are mentioned in available details.
Notable context includes the public availability of the exploit, increasing the risk of immediate exploitation against unpatched instances of VAM Virtual Airlines Manager.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6659
Vulnerability details
A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registry_id/plane_icao leads…
more
to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote SQL injection vulnerability in a public-facing web application (/vam/index.php) that can be exploited unauthenticated via crafted HTTP GET requests, directly enabling the T1190 technique for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of user-supplied HTTP GET parameters like ID, registry_id, and plane_icao to directly prevent SQL injection exploitation.
Mandates timely identification, reporting, and correction of flaws such as this SQL injection vulnerability in the VAM application.
Enables regular vulnerability scanning of hosted web applications to detect and remediate SQL injection issues like CVE-2025-2353 before exploitation.