CVE-2025-55444

Katalog CVE

CVSS 9.8 · Critical EPSS 0,83%

Kerentanan Improper Input Validation pada vishalmathur online artwork and fine arts project. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can inject arbitrary SQL queries, leading to database enumeration and potential remote code execution.

Rincian

Terbit di NVD

20 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/Anudeepkadambala/88c6065f1de1597be96e50a573cde56e advisory pihak ketiga
• https://github.com/Anudeepkadambala/CVE-Reports/blob/main/CVE-2025-55444_Disclosure.md exploit · advisory pihak ketiga
• https://github.com/Anudeepkadambala/CVE-Reports/security/advisories/GHSA-r4mf-mr9h-f27m exploit · advisory pihak ketiga
• https://github.com/mathurvishal/Online-Artwork-and-Fine-Arts-MCA-Major-Project product