Is there a public PoC exploit available for CVE-2025-12308?

Yes, a public proof-of-concept exploit is available for CVE-2025-12308. Prioritise patching immediately. EPSS: 0.0%.

Nero Social Networking Site CVE-2025-12308

Q: What is the CVSS score of CVE-2025-12308?

CVE-2025-12308 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-27 cna@vuldb.com

PHP SQLi Nero Social Networking Site Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable SQLi with no confirmed auth gate (PR:N per VulDB); partial C/I/A impact; no scope change to other systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:10 vuln.today

CVE Published

Oct 27, 2025 - 19:16 cve.org

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletemessage.php. Performing manipulation of the argument message_id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

AnalysisAI

SQL injection in Nero Social Networking Site 1.0 exposes the /deletemessage.php endpoint to unauthenticated remote attackers who can manipulate the message_id parameter to execute arbitrary SQL commands against the backend database. The affected product is a PHP-based hobbyist/academic application (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0). A public proof-of-concept exploit has been released on GitHub, though EPSS remains at 0.03% (8th percentile), indicating negligible observed exploitation activity consistent with the product's near-zero production deployment footprint.

Technical ContextAI

The vulnerability exists in a PHP web application (Nero Social Networking Site 1.0) hosted on the code-projects platform. The /deletemessage.php file accepts a message_id GET or POST parameter that is concatenated directly into a SQL query without sanitization or parameterization, constituting a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection) defect, specifically SQL injection. The affected CPE is cpe:2.3:a:fabian:nero_social_networking_site:1.0:*:*:*:*:*:*:*. Because the application is PHP-based with no evidence of an ORM or prepared-statement layer, the flaw likely reflects direct string interpolation of untrusted input into a SQL statement - a foundational secure-coding failure. The CVSS 4.0 vector confirms no attack complexity or prerequisites beyond network access.

RemediationAI

No vendor-released patch has been identified at time of analysis. Since this is an open-source academic project with no formal patch release process, the primary fix is to rewrite /deletemessage.php to use PHP PDO or MySQLi prepared statements for the message_id parameter, eliminating direct SQL string interpolation - this removes the vulnerability entirely with no functional side effects. As a compensating control, restrict access to /deletemessage.php via web server configuration (e.g., Apache <Files> directive or nginx location block) to authenticated sessions only, which limits exposure if application-layer authentication is already enforced elsewhere. A WAF rule blocking SQLi patterns on the message_id parameter (e.g., ModSecurity CRS rule 942100) can block automated exploitation but is bypassable by determined attackers and should not be the sole control. The public POC at https://github.com/yuan466/CVE/blob/main/three/report.md and VulDB advisory at https://vuldb.com/?id.329980 provide technical reproduction details useful for patch verification. Deployment of this software in any production or internet-accessible context is not recommended without a full security review.