CLTPHP CVE-2025-12248
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint with no complexity; partial C/I/A reflects limited SQL injection impact without full DB compromise confirmed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in CLTPHP 3.0. The affected element is an unknown function of the file /home/search.html. Such manipulation of the argument keyword leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in CLTPHP 3.0 exposes the application's database to unauthenticated remote attackers via the keyword parameter in the /home/search.html search endpoint. The vulnerability stems from unsanitized user input being passed directly into SQL query construction, enabling data extraction and potential modification. A public proof-of-concept exploit has been disclosed (E:P in the CVSS 4.0 vector), though EPSS of 0.03% at the 7th percentile indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
Technical ContextAI
CLTPHP is a PHP-based content management system. The vulnerability resides in the search handler at /home/search.html, where the keyword GET/POST parameter is incorporated into a backend SQL query without adequate input sanitization or parameterized query usage. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), the parent class that encompasses SQL injection (CWE-89). This pattern - direct string concatenation of user-controlled input into SQL - is a foundational PHP web application flaw, typically indicating absence of prepared statements or PDO-bound parameters in the affected function. No CPE strings were provided; the affected product is identified solely as CLTPHP version 3.0 from VulDB reporting.
Affected ProductsAI
CLTPHP version 3.0 is confirmed affected, specifically the search functionality exposed at /home/search.html. No CPE string was provided in the source data; the version attribution derives from VulDB entry ID 329919 and the public GitHub issue at https://github.com/1276486/CVE/issues/17. No other versions are confirmed affected or unaffected by the available data, and the vendor has not published an official advisory.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis - the disclosure exists only via VulDB (https://vuldb.com/?id.329919) and a researcher GitHub issue (https://github.com/1276486/CVE/issues/17), with no corresponding vendor security advisory. The primary remediation is to refactor the search query in the /home/search.html handler to use prepared statements with bound parameters (PDO or MySQLi), eliminating direct string interpolation of the keyword input. As a compensating control, operators should apply a web application firewall rule to block common SQL injection patterns (e.g., UNION SELECT, single-quote sequences) on the keyword parameter - though WAF bypass is possible and this is not a substitute for code-level fixes. Additionally, restricting database user permissions for the CMS application account to SELECT-only on required tables limits the impact of successful injection. Disabling the public search feature entirely, if not business-critical, removes the attack surface with no direct trade-off beyond user functionality.
Share
External POC / Exploit Code
Leaving vuln.today