Cyber Posture

CVE-2025-25914

CriticalPublic PoC

Published: 17 March 2025

Published
17 March 2025
Modified
08 April 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0180 82.9th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25914 is a critical-severity SQL Injection (CWE-89) vulnerability in Carmelo Online Exam Mastering System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 directly prevents SQL injection by validating and sanitizing the fid parameter to reject malicious SQL payloads.

prevent

SI-2 ensures timely remediation of the specific SQL injection flaw in Online Exam Mastering System v1.0 to eliminate the vulnerability.

prevent

SI-9 restricts the types, formats, and quantity of inputs to the fid parameter, blocking oversized or malformed SQL injection attempts.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection vulnerability in a public-facing web application (Online Exam Mastering System) allows remote arbitrary code execution via the fid parameter, directly enabling exploitation of public-facing applications.

NVD Description

SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter

Deeper analysisAI

CVE-2025-25914, published on 2025-03-17, is a SQL injection vulnerability (CWE-89) in Online Exam Mastering System version 1.0. The flaw resides in the handling of the fid parameter, enabling a remote attacker to execute arbitrary code. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.

A remote attacker without privileges or user interaction can exploit the vulnerability by injecting malicious SQL payloads via the fid parameter. Successful exploitation allows arbitrary code execution, compromising confidentiality, integrity, and availability with high impact, potentially leading to full system control.

The primary advisory reference is available at https://github.com/872323857/CVE/blob/main/online-exam-mastering-system_sqlinject.md, which details the vulnerability but provides no specific mitigation or patch information in the given data.

Details

CWE(s)

Affected Products

carmelo
online exam mastering system
1.0

CVEs Like This One

CVE-2026-26711Same vendor: Carmelo
CVE-2026-26710Same vendor: Carmelo
CVE-2026-26695Same vendor: Carmelo
CVE-2026-26696Same vendor: Carmelo
CVE-2026-26712Same vendor: Carmelo
CVE-2026-3705Same vendor: Carmelo
CVE-2026-3744Same vendor: Carmelo
CVE-2026-3711Same vendor: Carmelo
CVE-2026-3745Same vendor: Carmelo
CVE-2026-5017Same vendor: Carmelo

References