PT-2025-17203 · Foxcms · Foxcms

X1Lys · Published 2025-04-17 · Updated 2025-04-19 · CVE-2025-29180

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FOXCMS versions 1.25 and earlier

Description The issue concerns a time-based blind SQL injection vulnerability in the installdb.php file. The url prefix, domain, and my website POST parameters are directly concatenated into SQL statements without filtering.

Recommendations For FOXCMS versions 1.25 and earlier, as a temporary workaround, consider filtering or validating the url prefix, domain, and my website parameters to prevent SQL injection attacks. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-29180

Affected Products

Foxcms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-29180 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29180 · Vendor Advisory
• https://gist.github.com/X1lyS/5075ba1e6bebff26fcd58609493fd5f2 · Note
• https://twitter.com/cybercronai/status/1913367444673998946 · Twitter Post
• https://twitter.com/CVEnew/status/1913455527209693587 · Twitter Post
• https://t.me/cvetracker/21862 · Telegram Post
• https://t.me/cvedetector/23250 · Telegram Post