PT-2025-47009 · Cloudlog · Cloudlog

Published 2025-11-14 · Updated 2025-11-19 · CVE-2025-64084

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cloudlog versions 2.7.5 and earlier

Description An authenticated SQL injection issue exists. The vucc details ajax function within the application/controllers/Awards.php file does not properly sanitize the Gridsquare POST parameter provided by the user. This allows a remote, authenticated attacker to execute arbitrary SQL commands by injecting a malicious payload. The payload is then directly concatenated into a raw SQL query within the vucc qso details function.

Recommendations Versions prior to 2.7.5 should be updated.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-64084

GHSA-4R9R-3R3Q-JG44

Affected Products

Cloudlog

References · 11

• 🔥 https://github.com/XY20130630/Cloudlog/security/advisories/GHSA-4r9r-3r3q-jg44 · Exploit
• https://github.com/magicbug/Cloudlog/commit/72a8c3d705c8629f60f64da9f37968417c980242 · Patch
• https://osv.dev/vulnerability/CVE-2025-64084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64084 · Security Note
• https://github.com/magicbug/Cloudlog/releases/tag/2.7.6 · Note
• https://t.me/cveNotify/143411 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1989453171270246777 · Twitter Post
• https://t.me/cveNotify/142954 · Telegram Post
• https://twitter.com/CVEnew/status/1989442002141024282 · Twitter Post
• https://twitter.com/AnonOzzyDude/status/1990175600363925748 · Twitter Post
• https://t.me/CVEtracker/37372 · Telegram Post