PT-2025-48773 · Unknown · Lvzhou Cms

Wu Xiaoran · Published 2025-12-02 · Updated 2025-12-09 · CVE-2025-65877

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lvzhou CMS versions prior to commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22)

Description The software contains a SQL injection flaw due to unsanitized input. Specifically, the title parameter within the com.wanli.lvzhoucms.service.ContentService#findPage function is directly incorporated into a dynamic SQL query without proper sanitization or the use of prepared statements. This allows attackers to potentially read sensitive data from the database. The vulnerable parameter is title.

Recommendations Update Lvzhou CMS to commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) or a later version.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-65877

Affected Products

Lvzhou Cms

References · 7

• 🔥 https://github.com/W000i/vuln/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65877 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65877 · Vendor Advisory
• https://t.me/CVEtracker/38718 · Telegram Post
• https://t.me/cveNotify/145236 · Telegram Post
• https://twitter.com/CVEnew/status/1995943880827535642 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1996106236027125788 · Twitter Post