PT-2025-3875 · Unknown · Liujianview Gymxmjpa

Lvzc3 · Published 2025-01-12 · Updated 2025-01-13 · CVE-2025-0404

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions liujianview gymxmjpa version 1.0

Description A critical vulnerability has been found in the CoachController function of the file src/main/java/com/liujian/gymxmjpa/controller/CoachController.java. The manipulation of the coachName argument leads to SQL injection. The attack can be initiated remotely. The details of the exploit are available to the public, which means it may be used by attackers.

Recommendations As a temporary workaround, consider disabling the CoachController function until a patch is available. Restrict access to the coachName argument in the CoachController function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-0404

Affected Products

Liujianview Gymxmjpa

References · 10

• 🔥 https://github.com/liujianview/gymxmjpa/issues/2#issue-2765760967 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-0404 · Security Note
• https://github.com/liujianview/gymxmjpa/issues/2 · Note
• https://twitter.com/CVEnew/status/1878632379096469585 · Twitter Post
• https://vuldb.com/?id.291280 · Note
• https://t.me/cvedetector/15113 · Telegram Post
• https://vuldb.com/?ctiid.291280 · Note
• https://vuldb.com/?submit.473385 · Note
• https://t.me/cvenotify/107173 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1878536332500230288 · Twitter Post