CVE-2025-2951
Published: 30 March 2025
Summary
CVE-2025-2951 is a medium-severity Injection (CWE-74) vulnerability in Bluestar Micro Mall. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2951 is a critical SQL injection vulnerability in Bluestar Micro Mall 1.0, affecting an unknown function within the file /api/data.php. The issue arises from improper handling of the 'Search' argument, allowing manipulation that leads to SQL injection as classified under CWE-74 and CWE-89. Published on 2025-03-30, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating network-accessible exploitation with low complexity and requiring low privileges.
Attackers can exploit this vulnerability remotely by manipulating the 'Search' parameter in requests to /api/data.php. Exploitation requires low privileges (PR:L), such as those of an authenticated user, and no user interaction. Successful attacks enable limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially allowing unauthorized data access, modification, or disruption via injected SQL payloads.
Advisories from VulDB detail the vulnerability, including submission records and exploit disclosure, available at references such as https://vuldb.com/?ctiid.302004, https://vuldb.com/?id.302004, and https://vuldb.com/?submit.521162, along with analysis on Jianshu at https://www.jianshu.com/p/22d3ae38e628. The exploit has been publicly disclosed and may be used by attackers.
In notable context, the public availability of the exploit increases the risk of active exploitation against unpatched Bluestar Micro Mall 1.0 instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8679
Vulnerability details
A vulnerability classified as critical has been found in Bluestar Micro Mall 1.0. Affected is an unknown function of the file /api/data.php. The manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote SQL injection in a public-facing web API (/api/data.php), directly enabling exploitation of public-facing applications (T1190). It facilitates unauthorized database queries for data access (T1213.006) via the 'Search' parameter manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of the 'Search' argument at the API entry point in /api/data.php to block malicious payloads.
Mandates timely remediation of the specific SQL injection flaw in Bluestar Micro Mall 1.0, including patching to eliminate the vulnerability.
Requires vulnerability scanning that would identify the SQL injection issue in /api/data.php, enabling detection and proactive patching.