What is the CVSS score of CVE-2025-46154?

CVE-2025-46154 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-46154?

FoxCMS v1.25 contains a critical SQL injection vulnerability in the database installation function that could allow attackers to extract sensitive data or compromise system integrity.

How to fix or mitigate CVE-2025-46154?

Within 24 hours: Audit network access to installdb.php and restrict access to trusted administrative IP addresses only. Within 7 days: Inventory all FoxCMS v1.25 installations and evaluate migration to a patched version or alternative CMS platform. Within 30 days: Complete migration off vulnerable version or implement permanent network-level access controls with documented compensating controls review.

PHP CVE-2025-46154

EUVD-2025-16731 HIGH

SQL Injection (CWE-89)

2025-06-03 cve@mitre.org

PHP SQLi Foxcms

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16731

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 14:15 nvd

HIGH 8.4

DescriptionCVE.org

Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.

AnalysisAI

Foxcms v1.25 contains a SQL time-based injection vulnerability in the installdb.php installation script, specifically in the $_POST['dbname'] parameter, allowing unauthenticated local attackers to execute arbitrary SQL commands and fully compromise database confidentiality, integrity, and availability. With a CVSS score of 8.4 and local attack vector, this vulnerability poses a significant risk during initial application deployment; exploitation status and POC availability should be confirmed against current threat intelligence feeds, though the high CVSS and local-only requirement suggests moderate real-world impact depending on deployment model.

Technical ContextAI

The vulnerability stems from insufficient input sanitization in the database installation routine (installdb.php), where user-supplied input from the $_POST['dbname'] parameter is concatenated directly into SQL queries without proper parameterization or prepared statement usage. This represents a classic instance of CWE-89 (SQL Injection), specifically a time-based blind SQL injection variant where attackers infer database content through response time delays. The affected component is Foxcms v1.25 (CPE would be: cpe:2.3:a:foxcms:foxcms:1.25:*:*:*:*:*:*:*), a content management system. The installation script typically lacks the application-level authentication controls present in production code, making this an attractive attack surface for initial compromise during setup or post-deployment misconfiguration scenarios.

RemediationAI

Patching: Upgrade to Foxcms version > 1.25 if available (vendor advisory required to confirm patched version). Check official Foxcms repository or vendor security page for available patches. Immediate Mitigation: Delete or restrict access to installdb.php post-installation using filesystem permissions or web server configuration (e.g., Apache .htaccess or Nginx location block). Code-Level Fix: Implement prepared statements with parameterized queries in installdb.php: use placeholders (?) instead of string concatenation. Example: $stmt = $pdo->prepare('CREATE DATABASE ?'); $stmt->execute([$dbname]);. Validate and sanitize $_POST['dbname'] against whitelist of allowed database names (alphanumeric + underscore only). Access Control: Restrict installdb.php execution to localhost/127.0.0.1 only via web server configuration or .htaccess rules. Input Validation: Implement strict input validation: reject database names containing SQL keywords, special characters, or exceeding expected length. Use regex: ^[a-zA-Z0-9_]+$ before processing.