PT-2025-17314 · Unknown · Namelessmc

Vz0N · Published 2025-04-18 · Updated 2025-04-18 · CVE-2025-32389

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions NamelessMC versions prior to 2.1.4

Description The issue is related to SQL injection by providing an unexpected square bracket GET parameter syntax. This syntax refers to the structure ?param[0]=a&param[1]=b&param[2]=c utilized by PHP, which is parsed by PHP as $ GET['param'] being of type array.

Recommendations For versions prior to 2.1.4, update to version 2.1.4 to resolve the issue. As a temporary workaround, consider restricting access to API endpoints that utilize the square bracket GET parameter syntax until the update is applied. Avoid using the square bracket syntax in GET parameters for affected versions until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-32389

GHSA-5984-MHCP-CQ2X

Affected Products

Namelessmc

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32389.json · Exploit
• https://github.com/NamelessMC/Nameless/commit/02c81c7c45b98fad1ebe3bc085efae18aec4566f · Patch
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-5984-mhcp-cq2x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32389 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32389 · Vendor Advisory
• https://github.com/NamelessMC/Nameless/releases/tag/v2.1.4 · Note
• https://t.me/cvedetector/23310 · Telegram Post
• https://twitter.com/CVEnew/status/1913312931108048960 · Twitter Post
• https://t.me/cvetracker/21933 · Telegram Post
• https://t.me/latest_high_impact_cve/2158 · Telegram Post