High severity · published Jan 24, 2025
CVE-2025-0700
JoeyBling bootplus list sql injection
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/sys/log/list. The manipulation of the argument logId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
bootplus · JoeyBling
247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0700
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0700
Not Applicable
https://github.com/JoeyBling/bootplus/issues/22
Not Applicable
https://github.com/JoeyBling/bootplus/issues/22#issue-2786899884
Permissions Required
https://vuldb.com/?ctiid.293228
Third Party Advisory
https://vuldb.com/?id.293228
Third Party Advisory
https://vuldb.com/?submit.480838
More from bootplus
8.8
CVE-2025-0702
JoeyBling bootplus SysFileController.java unrestricted upload
8.8
CVE-2025-0701
JoeyBling bootplus list sql injection
8.8
CVE-2025-0699
JoeyBling bootplus list sql injection
8.8
CVE-2025-0698
JoeyBling bootplus list sql injection
6.1
CVE-2025-0705
JoeyBling bootplus QrCodeController.java qrCode redirect
