Cyber Resilience

CVE-2025-2831

MediumPublic PoC

Published: 27 March 2025

Published
27 March 2025
Modified
11 April 2025
KEV Added
—
Patch
—
CVSS Score v4 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0011 28.9th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2831 is a medium-severity Injection (CWE-74) vulnerability in Mingyuefusu Library Management System. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-2831 is a critical SQL injection vulnerability in the mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统, affecting versions up to commit d4836fusu d4836f6b49cd0ac79a4021b15ce99ff7229d4694. The flaw impacts the getBookList function in the /admin/bookList?page=1&limit=10 endpoint, where manipulation of the 'condition' argument triggers the injection.

The vulnerability enables remote exploitation by low-privileged users (PR:L), with low attack complexity (AC:L) and no need for user interaction (UI:N). Attackers can achieve limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), as reflected in its CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). It maps to CWEs 74 (Improper Neutralization of Special Elements) and 89 (SQL Injection).

Advisories on VulDB (vuldb.com/?ctiid.301468, vuldb.com/?id.301468, vuldb.com/?submit.521458) and Gitee issues for the repository (gitee.com/mingyuefusu/tushuguanlixitong/issues/IBTSJL) provide further details on the issue.

The exploit has been publicly disclosed and may be used in attacks.

EU & UK References

Vulnerability details

A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vulnerability affects the function getBookList of the file /admin/bookList?page=1&limit=10. The manipulation of the argument condition leads to sql injection. The attack can…

more

be initiated remotely. The exploit has been disclosed to the public and may be used.

CWE(s)
CWE-74CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in web app endpoint (/admin/bookList) directly enables remote exploitation of public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-3150Shared CWE-74, CWE-89
CVE-2026-3746Shared CWE-74, CWE-89
CVE-2025-2683Shared CWE-74, CWE-89
CVE-2026-5238Shared CWE-74, CWE-89
CVE-2026-4288Shared CWE-74, CWE-89
CVE-2026-2220Shared CWE-74, CWE-89
CVE-2025-1535Shared CWE-74, CWE-89
CVE-2026-0597Shared CWE-74, CWE-89
CVE-2026-1688Shared CWE-74, CWE-89
CVE-2026-5018Shared CWE-74, CWE-89

Affected Assets

mingyuefusu
library management system
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of the 'condition' argument in the getBookList function to neutralize SQL injection attempts.

SI-2 Flaw Remediation good match
preventrecover

Directly remediates the SQL injection flaw in mingyuefusu tushuguanlixitong up to commit d4836f6b49cd0ac79a4021b15ce99ff7229d4694.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Vulnerability scanning detects SQL injection in the /admin/bookList endpoint as in CVE-2025-2831.

References