loganSite CVE-2025-15014

Exploitation requires reaching the /includes/article_detail.php endpoint of the Article Handler component and supplying a manipulated ID parameter. Per the CVSS 4.0 vector's PR:L, a low-privileged authenticated session is required, which meaningfully limits exposure versus a fully unauthenticated flaw; there is no required user interaction (UI:N) and no special non-default configuration is named in the description. Because loganSite ships as a rolling release with no version tags, defenders cannot pin exploitability to a release and must assess against the current deployed commit relative to c035fb5c3edd0b2a5e32fd4051cbbc9e61a31426.

This is a medium-severity SQL injection (CVSS 4.0 base 5.3) with limited real-world urgency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates network-reachable, low-complexity exploitation but requires low-level privileges (PR:L) and yields only LOW confidentiality, integrity, and availability impact with no scope change - consistent with a non-admin authenticated user injecting through the ID parameter rather than a full unauthenticated database takeover. EPSS is low at 0.23% (13th percentile), the vulnerability is NOT in CISA KEV, and no POC flag is present in the supplied data, so all three exploitation signals agree this is low-priority and not under active or imminent mass exploitation. The only tension is that one reference (github.com/ssiled/cve/issues/1) is a public issue tracker that may contain reproduction details, but no POC=YES flag was provided, so proof-of-concept availability is unconfirmed. Note also that the record is tagged CWE-74 (generic injection) while the description is specifically SQL injection (CWE-89) - the classification is broader than the actual flaw. Net: a legitimate but low-priority finding, driven more by product obscurity and limited impact than by any high-risk signal.

An attacker with a low-privileged account on a loganSite deployment sends a crafted request to /includes/article_detail.php with a malicious ID parameter, injecting SQL that the Article Handler passes unsanitized into a query. Because impact is rated LOW across C/I/A, the realistic outcome is partial disclosure or modification of article/database data rather than full database compromise. No public exploit code is confirmed in the provided data, though a referenced GitHub issue may document reproduction steps.