High severity · published Jan 24, 2025
CVE-2025-0698
JoeyBling bootplus list sql injection
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been classified as critical. Affected is an unknown function of the file /admin/sys/menu/list. The manipulation of the argument sort/order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
bootplus · JoeyBling
247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0698
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0698
Not Applicable
https://github.com/JoeyBling/bootplus/issues/19
Not Applicable
https://github.com/JoeyBling/bootplus/issues/19#issue-2786879797
Permissions Required
https://vuldb.com/?ctiid.293226
Third Party Advisory
https://vuldb.com/?id.293226
Third Party Advisory
https://vuldb.com/?submit.480827
More from bootplus
8.8
CVE-2025-0702
JoeyBling bootplus SysFileController.java unrestricted upload
8.8
CVE-2025-0701
JoeyBling bootplus list sql injection
8.8
CVE-2025-0700
JoeyBling bootplus list sql injection
8.8
CVE-2025-0699
JoeyBling bootplus list sql injection
6.1
CVE-2025-0705
JoeyBling bootplus QrCodeController.java qrCode redirect