Ghost Hot Spot CVE-2025-12342

Q: What is the CVSS score of CVE-2025-12342?

CVE-2025-12342 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-28 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Remote unauthenticated SQL injection in public login form; high confidentiality and integrity impact from direct database access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 05:03 vuln.today

DescriptionCVE.org

A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login. This manipulation causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote unauthenticated SQL injection in Ghost Hot Spot's login form allows direct database manipulation and potential authentication bypass for versions up to 20251014, confirmed by published POC code. The extremely low EPSS score (0.03%, 7th percentile) contradicts technical exploitability metrics, suggesting limited real-world threat from this niche product. Vendor non-response precludes a timely security patch.

Technical ContextAI

This is a CWE-74 (Improper Neutralization of Special Elements) SQL injection vulnerability in a PHP web application. The /Auth.php file handles user authentication but fails to properly sanitize login input before passing it to database queries. Attackers can inject malicious SQL syntax through login form parameters (likely username or password fields) to manipulate the intended SQL logic, potentially bypassing authentication or extracting sensitive data from the database.

Affected ProductsAI

Serdar Bayram Ghost Hot Spot is affected in versions up to and including version 20251014. The vendor was contacted early about this disclosure but did not respond. No specific vendor advisory or official patch is available from the publisher.

RemediationAI

No vendor-released patch is available; vendor did not respond to early disclosure contact. Deploy a web application firewall (WAF) with SQL injection protection rules to block malicious login requests. Implement network segmentation to restrict direct access to the login endpoint to trusted sources. Enable database query logging and anomaly detection to identify exploitation attempts. If source code is available, apply SQL input validation and parameterized queries to /Auth.php directly. For long-term security, consider migrating to an actively maintained authentication system. Each control involves trade-offs (false positives from WAF rules, access restrictions limiting legitimate users, monitoring overhead, code modification risk).