Nero Social Networking Site
CVE-2025-12307
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated SQL injection with limited partial impact on C/I/A and no scope change beyond the application's own database.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfriend.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
AnalysisAI
SQL injection in the /addfriend.php endpoint of Nero Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL against the underlying database. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.03% (8th percentile) indicates negligible observed in-the-wild activity. The product is a PHP-based academic demo application from code-projects.org, substantially limiting real-world exposure despite the straightforward attack vector.
Technical ContextAI
Nero Social Networking Site 1.0 is a PHP-based social networking demo application (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0:*:*:*:*:*:*:*) distributed via code-projects.org. The root cause is classified under CWE-74 (Injection), with the specific manifestation being SQL injection - user-supplied input in the ID parameter of /addfriend.php is interpolated directly into a database query without parameterization, prepared statements, or adequate escaping. This is a textbook failure to separate data from code in a PHP/MySQL stack, a class of vulnerability that has been well-understood since at least OWASP's original Top 10. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no architectural barriers exist to exploitation beyond network reachability.
RemediationAI
No vendor-released patch has been identified at time of analysis - code-projects.org demo projects are typically released as static downloads with no ongoing maintenance or security patching lifecycle. The primary recommended action is to immediately decommission any internet-accessible or production deployment of this application, as it is a demonstration project not designed for secure production use. If continued operation is operationally required, implement a WAF rule to reject or sanitize non-numeric and metacharacter-containing values in the ID parameter sent to /addfriend.php; this is a compensating control only and does not address the root cause. Additionally, restrict network-level access to the /addfriend.php endpoint via firewall or reverse-proxy ACLs to authorized internal IP ranges only, noting this introduces an operational barrier for intended users. The database account used by the application should be audited and restricted to minimum necessary privileges to limit SQL injection impact. Technical details are available at https://vuldb.com/?id.329979 and the POC at https://github.com/yuan466/CVE/blob/main/two/report.md.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today