CVE-2025-2654
Published: 23 March 2025
Summary
CVE-2025-2654 is a high-severity Injection (CWE-74) vulnerability in Oretnom23 Ac Repair And Services System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 enforces validation of inputs like the ID parameter, directly preventing SQL injection by neutralizing special elements used in SQL commands.
SI-2 requires timely identification and correction of flaws such as the SQL injection vulnerability in /admin/services/manage_service.php.
RA-5 mandates vulnerability scanning to detect SQL injection issues like CVE-2025-2654 and subsequent remediation to prevent exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote SQL injection in public-facing web application (/admin/services/manage_service.php) enables initial access via exploitation of public-facing application (T1190), unauthorized data collection from backend databases (T1213.006), and manipulation/corruption of stored database data (T1565.001).
NVD Description
A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/services/manage_service.php. The manipulation of the argument ID leads to sql injection. It is possible…
more
to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2654 is a critical SQL injection vulnerability in SourceCodester AC Repair and Services System 1.0, affecting an unknown part of the file /admin/services/manage_service.php through manipulation of the ID argument. Published on 2025-03-23T16:15:13.840, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).
The vulnerability enables remote exploitation by unauthenticated attackers with low attack complexity and no user interaction required. Successful exploitation can result in limited impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL payloads.
Advisories and exploit details are documented in references including VulDB entries (ctiid.300669, id.300669, submit.520013), a GitHub repository at Colorado-all/cve containing an exploit PoC (SQL-4.md), and the SourceCodester website. No specific patch or mitigation guidance is detailed in the initial disclosure.
The exploit has been publicly disclosed and may be used in real-world attacks against exposed instances of the affected system.
Details
- CWE(s)