KodiCMS
CVE-2025-15392
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible search endpoint requires low-privilege authentication; SQL injection yields partial data read/write but no availability or scope impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in Kohana KodiCMS up to 13.82.135. This affects the function like of the file cms/modules/pages/classes/kodicms/model/page.php of the component Search API Endpoint. Executing manipulation of the argument keyword can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in KodiCMS (Kohana variant) up to version 13.82.135 allows remote low-privileged attackers to manipulate database queries through the keyword argument in the Search API Endpoint's like function. The vendor was notified but did not respond, leaving no official patch available. A public exploit exists, though EPSS probability sits at 0.04% (12th percentile), indicating minimal observed exploitation activity despite POC availability - no public exploit identified as confirmed actively exploited (CISA KEV).
Technical ContextAI
KodiCMS is a PHP-based content management system built on the Kohana framework. The vulnerability resides in the like function within cms/modules/pages/classes/kodicms/model/page.php, which handles page search queries via the Search API Endpoint. The affected CPE is cpe:2.3:a:kodicms-kohana:kodicms:*:*:*:*:*:*:*:*, covering all tracked versions through 13.82.135. The root cause is classified as CWE-74 (Injection), the parent class encompassing SQL injection (CWE-89): user-supplied keyword input is incorporated into a SQL LIKE clause without adequate sanitization or parameterized query use, allowing an attacker to break out of the intended query context and inject arbitrary SQL. PHP CMS applications built on older MVC frameworks like Kohana often lack modern ORM-level query binding in legacy model files.
RemediationAI
No vendor-released patch has been identified at time of analysis, as the vendor did not respond to disclosure. Operators should consider replacing the like function in cms/modules/pages/classes/kodicms/model/page.php with parameterized queries or prepared statements using Kohana's DB query builder (e.g., DB::select()->where('field', 'LIKE', $value)) rather than raw string interpolation - this is the definitive fix, though it requires manual code patching. As a compensating control, restrict access to the Search API Endpoint to trusted, authenticated roles only via application-level middleware or web server ACLs (e.g., nginx limit_except or .htaccess IP restriction), accepting the trade-off that this reduces search functionality for broader user bases. Input validation filtering keyword to alphanumeric characters reduces injection surface but may break legitimate search terms with special characters. Consider disabling the search endpoint entirely if it is not a business-critical feature. Monitor VulDB (https://vuldb.com/?id.339161) for any subsequent vendor response or patch release.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today