Chamber Of Commerce Membership Management System
Monthly
Command injection in code-projects Chamber of Commerce Membership Management System 1.0 allows authenticated remote attackers with high privileges to execute arbitrary commands via manipulation of the mailSubject and mailMessage parameters in the admin/pageMail.php file. The vulnerability has a publicly available exploit and a moderate CVSS score of 4.7, but real-world risk is constrained by the requirement for high-privilege authenticated access.
We need to create a comprehensive JSON analysis for CVE-2025-14205, synthesizing all provided data. The input includes: description, CVSS score 1.9 with vector, CWE-79 (XSS), EPSS 0.03% (low), CPE for fabian chamber_of_commerce_membership_management_system:1.0, tags XSS, PHP, etc. No KEV mentioned, no explicit patch data. POC is made public per description ("exploit has been made public"). Vulnerability: stored/reflected XSS? Description says "manipulation of the argument Full Name/Address/City/State results in cross site scripting". The component is "Your Info Handler" in /membership_profile.php. So likely stored XSS in profile fields. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. So PR:H (high privileges required), UI:P (passive user interaction?), VC:N (no confidentiality impact from vulnerable system), VI:L (low integrity impact to vulnerable system), VA:N. No scope change. Exploit maturity: P (Proof-of-concept). That indicates an exploit exists, consistent with "exploit has been made public." So we'll note that publicly available exploit code exists. No KEV, so not actively exploited. We need to produce fields. Product name: "Chamber of Commerce Membership Management System" is long, but rule: "1-3 words ONLY. The specific product or service name affected." So we could pick "Chamber of Commerce Membership Management System" but that's 6 words. Alternative: "Membership Management System"? Not precise. Possibly "code-projects Chamber CMS" or "Chamber CMS". But rule says: "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So the product is the software name, not the vendor. The vendor is "fabian" per CPE, product name in CPE: "chamber_of_commerce_membership_management_system". So I'd use "Chamber of Commerce Membership Management System". That is 6 words, but the rule says "1-3 words ONLY" – it might be acceptable as a proper name? The rule is strict: 1-3 words. That's challenging. Maybe "Comme
Command injection in code-projects Chamber of Commerce Membership Management System 1.0 allows authenticated remote attackers with high privileges to execute arbitrary commands via manipulation of the mailSubject and mailMessage parameters in the admin/pageMail.php file. The vulnerability has a publicly available exploit and a moderate CVSS score of 4.7, but real-world risk is constrained by the requirement for high-privilege authenticated access.
We need to create a comprehensive JSON analysis for CVE-2025-14205, synthesizing all provided data. The input includes: description, CVSS score 1.9 with vector, CWE-79 (XSS), EPSS 0.03% (low), CPE for fabian chamber_of_commerce_membership_management_system:1.0, tags XSS, PHP, etc. No KEV mentioned, no explicit patch data. POC is made public per description ("exploit has been made public"). Vulnerability: stored/reflected XSS? Description says "manipulation of the argument Full Name/Address/City/State results in cross site scripting". The component is "Your Info Handler" in /membership_profile.php. So likely stored XSS in profile fields. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. So PR:H (high privileges required), UI:P (passive user interaction?), VC:N (no confidentiality impact from vulnerable system), VI:L (low integrity impact to vulnerable system), VA:N. No scope change. Exploit maturity: P (Proof-of-concept). That indicates an exploit exists, consistent with "exploit has been made public." So we'll note that publicly available exploit code exists. No KEV, so not actively exploited. We need to produce fields. Product name: "Chamber of Commerce Membership Management System" is long, but rule: "1-3 words ONLY. The specific product or service name affected." So we could pick "Chamber of Commerce Membership Management System" but that's 6 words. Alternative: "Membership Management System"? Not precise. Possibly "code-projects Chamber CMS" or "Chamber CMS". But rule says: "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So the product is the software name, not the vendor. The vendor is "fabian" per CPE, product name in CPE: "chamber_of_commerce_membership_management_system". So I'd use "Chamber of Commerce Membership Management System". That is 6 words, but the rule says "1-3 words ONLY" – it might be acceptable as a proper name? The rule is strict: 1-3 words. That's challenging. Maybe "Comme