CVE-2025-25914
Published: 17 March 2025
Summary
CVE-2025-25914 is a critical-severity SQL Injection (CWE-89) vulnerability in Carmelo Online Exam Mastering System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by validating and sanitizing the fid parameter to reject malicious SQL payloads.
SI-2 ensures timely remediation of the specific SQL injection flaw in Online Exam Mastering System v1.0 to eliminate the vulnerability.
SI-9 restricts the types, formats, and quantity of inputs to the fid parameter, blocking oversized or malformed SQL injection attempts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in a public-facing web application (Online Exam Mastering System) allows remote arbitrary code execution via the fid parameter, directly enabling exploitation of public-facing applications.
NVD Description
SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter
Deeper analysisAI
CVE-2025-25914, published on 2025-03-17, is a SQL injection vulnerability (CWE-89) in Online Exam Mastering System version 1.0. The flaw resides in the handling of the fid parameter, enabling a remote attacker to execute arbitrary code. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.
A remote attacker without privileges or user interaction can exploit the vulnerability by injecting malicious SQL payloads via the fid parameter. Successful exploitation allows arbitrary code execution, compromising confidentiality, integrity, and availability with high impact, potentially leading to full system control.
The primary advisory reference is available at https://github.com/872323857/CVE/blob/main/online-exam-mastering-system_sqlinject.md, which details the vulnerability but provides no specific mitigation or patch information in the given data.
Details
- CWE(s)