CVE-2025-0296 in Online Book Shop
Summary
by MITRE • 01/07/2025
A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. The manipulation of the argument subcatid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2025
The vulnerability identified as CVE-2025-0296 represents a critical sql injection flaw within the code-projects Online Book Shop version 1.0 web application. This vulnerability specifically targets the /booklist.php file where the subcatid parameter is improperly handled, creating an exploitable condition that allows attackers to manipulate database queries through malicious input. The sql injection vulnerability stems from insufficient input validation and sanitization of user-supplied data, particularly in the subcatid argument which serves as the attack vector for database manipulation. The weakness exists in the application's data handling processes where user input directly influences sql query construction without proper parameterization or escaping mechanisms.
The operational impact of this vulnerability is severe as it enables remote code execution capabilities through sql injection attacks, allowing adversaries to gain unauthorized access to the underlying database system. Attackers can exploit this flaw to extract sensitive information including user credentials, personal data, and business-critical records stored within the database. The vulnerability's classification as critical reflects its potential to compromise the entire application infrastructure, as sql injection attacks can be leveraged to escalate privileges, modify database contents, or even establish persistent backdoors within the system. The fact that the exploit has been publicly disclosed significantly increases the risk profile, as it provides threat actors with readily available tools and techniques to target affected installations.
Security professionals should recognize this vulnerability as a direct instance of CWE-89 sql injection, which is categorized under the CWE Top 25 Most Dangerous Software Weaknesses. The attack surface aligns with ATT&CK technique T1190 exploitation for client execution, specifically targeting web application vulnerabilities through database manipulation. Organizations running this vulnerable software must implement immediate mitigations including input validation, parameterized queries, and web application firewalls to prevent exploitation. The remediation process should involve comprehensive code review and implementation of proper sql query construction techniques, including prepared statements and stored procedures to eliminate the injection vectors. Additionally, network segmentation and access controls should be enhanced to limit potential damage from successful exploitation attempts.