CVE-2025-1874

The attacker sends specially crafted input data through the 'description' parameter in the category addition form (admin/add-category.php). The application does not filter or parametrize the passed values, allowing arbitrary SQL commands to be injected directly into the query executed on the database server. The attack can be performed remotely, without authentication, and without any interaction on the victim's side.

An attacker can gain unauthorized access to data stored in the database, including authentication credentials, website content, and user data. Depending on server configuration, it is also possible to modify or delete data, and potentially execute system commands.

Patches available from the manufacturer should be applied according to references. It is also recommended to implement parameterized SQL queries (prepared statements) and validation and sanitization of input data on the server side. Until the patch is applied, consider restricting access to the admin panel only to trusted IP addresses.

101news application (Mayurik Best Online News Portal) version 1.0