CVE-2025-50972

CriticalPublic PoC

Published: 27 August 2025

Published

27 August 2025

Modified

08 September 2025

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0040 60.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-50972 is a critical-severity SQL Injection (CWE-89) vulnerability in Abantecart Abantecart. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-50972 is a SQL injection vulnerability affecting AbanteCart version 1.4.2. The flaw resides in the tmpl_id parameter passed to index.php, enabling unauthenticated attackers to execute arbitrary SQL commands. Demonstrated exploitation techniques include error-based injection using a crafted FLOOR-based payload, time-based blind injection via SLEEP(), and UNION-based injection for data extraction. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-89.

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows execution of arbitrary SQL commands, potentially leading to high confidentiality, integrity, and availability impacts, such as data exfiltration, modification, or denial of service.

A proof-of-concept is available at https://github.com/4rdr/proofs/blob/main/info/abantecart_sql_injection_1.4.2_via_template_parameter.md, which details the three injection techniques but does not specify mitigation steps or patches.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-25945

Vulnerability details

SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php. Three techniques have been demonstrated: error-based injection using a crafted FLOOR-based payload, time-based blind injection via SLEEP(), and UNION-based injection…

to extract arbitrary data.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection vulnerability in public-facing AbanteCart web application enables exploitation for initial access (T1190). Demonstrated UNION-based, error-based, and time-based techniques facilitate arbitrary data extraction from databases (T1213.006).