CVE-2025-1872

The vulnerability consists of insufficient validation and sanitization of input data passed through the 'sadminusername' parameter in the admin/add-subadmins.php endpoint. An attacker can inject malicious SQL code directly into the query executed on the database server side. Due to the lack of authentication requirement (PR:N, UI:N), the exploit can be performed remotely over the network without any user interaction.

An attacker can obtain unauthorized read, modification, or deletion of data in the application database, including administrator and sub-administrator credentials. Depending on the database server configuration, it is also possible to gain full control over the service data.

Patches available from the vendor should be applied according to the references. It is also recommended to implement parameterized queries (prepared statements) and restrict access to the administrative panel exclusively to trusted IP addresses.

101news application (Mayurik Best Online News Portal) version 1.0