EUVD-2025-16623
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionNVD
A vulnerability was found in Marwal Infotech CMS 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /page.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Critical SQL injection vulnerability in Marwal Infotech CMS 1.0 affecting the /page.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially extract, modify, or delete database contents. The vulnerability has public exploit disclosure and proof-of-concept availability, but the vendor has not responded to early disclosure notifications, leaving affected deployments unpatched and at active risk.
Technical ContextAI
This vulnerability stems from improper input validation and parameterization in the /page.php endpoint, classified under CWE-74 (Improper Neutralization of Special Elements in Output, 'Injection'). The ID parameter accepts unsanitized user input that is directly incorporated into SQL queries without prepared statements or parameterized query mechanisms. Marwal Infotech CMS 1.0 is a PHP-based content management system; the vulnerability exists in the page retrieval logic where ID-based lookups likely construct dynamic SQL strings. The root cause reflects a fundamental failure to implement proper output encoding and query parameterization, allowing attackers to manipulate SQL syntax and inject arbitrary commands into the database query execution context.
RemediationAI
Immediate remediation options are severely constrained due to vendor non-responsiveness: (1) UPGRADE/REPLACE: Migrate away from Marwal Infotech CMS 1.0 to an actively maintained alternative CMS (WordPress, Drupal, Joomla with current patches); (2) WORKAROUND (temporary): Implement Web Application Firewall (WAF) rules blocking SQL injection payloads in the ID parameter (monitor for UNION, SELECT, DROP, INSERT in parameter values; use regex patterns for common SQL injection syntax); (3) INPUT VALIDATION (emergency patch): If source code access exists, immediately implement parameterized queries or prepared statements for all page.php database operations—replace dynamic SQL with bound parameters; (4) NETWORK ISOLATION: Restrict /page.php access via IP allowlisting or authentication layer; (5) DATABASE HARDENING: Apply principle of least privilege to database user accounts (read-only access where possible); enable SQL query logging and monitoring for anomalous activity. No official vendor patch is expected given non-responsiveness.
Share
External POC / Exploit Code
Leaving vuln.today