Cyber Posture

CVE-2025-3038

MediumPublic PoC

Published: 31 March 2025

Published
31 March 2025
Modified
14 May 2025
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0013 32.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-3038 is a medium-severity Injection (CWE-74) vulnerability in Fabian Payroll Management System. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents SQL injection by validating the salary_rate parameter in /view_account.php against malicious inputs.

prevent

Requires timely remediation of the SQL injection flaw in Payroll Management System 1.0 to eliminate the vulnerability.

prevent

Limits database privileges for the application process to minimize impacts from successful salary_rate SQL injection exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing web application (/view_account.php) enables initial access via exploitation of public-facing application (T1190) and facilitates unauthorized data collection from backend databases (T1213.006).

NVD Description

A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /view_account.php. The manipulation of the argument salary_rate leads to sql injection. The attack may be initiated remotely.…

more

The exploit has been disclosed to the public and may be used.

Deeper analysisAI

CVE-2025-3038 is a critical SQL injection vulnerability in code-projects Payroll Management System 1.0, affecting the processing of the /view_account.php file. The issue arises from improper handling of the salary_rate argument, allowing manipulation that leads to SQL injection (CWE-74, CWE-89). It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-31.

The vulnerability can be exploited remotely by an attacker with low privileges, requiring low complexity and no user interaction. Successful exploitation enables limited impacts on confidentiality, integrity, and availability through SQL injection, potentially allowing unauthorized data access, modification, or disruption within the affected application's database.

Advisories from sources like VulDB (ctiid.302099, id.302099) and a GitHub repository document the issue, noting that the exploit has been publicly disclosed and may be used. No specific patches or mitigations are detailed in the available references; security practitioners should monitor the vendor site at code-projects.org for updates and apply input validation or parameterized queries to /view_account.php as interim defenses.

Details

CWE(s)

Affected Products

fabian
payroll management system
1.0

CVEs Like This One

CVE-2025-2672Same product: Fabian Payroll Management System
CVE-2025-2985Same product: Fabian Payroll Management System
CVE-2025-2854Same product: Fabian Payroll Management System
CVE-2025-2984Same product: Fabian Payroll Management System
CVE-2025-3039Same product: Fabian Payroll Management System
CVE-2025-0874Same vendor: Fabian
CVE-2025-2392Same vendor: Fabian
CVE-2025-0230Same vendor: Fabian
CVE-2025-2391Same vendor: Fabian
CVE-2025-1197Same vendor: Fabian

References