CVE-2025-0490: Native-php-cms SQL Injection Vulnerability

CVE-2025-0490 Overview

CVE-2025-0490 is a SQL injection vulnerability in Fanli2012 native-php-cms version 1.0. The flaw resides in the /fladmin/article_dodel.php script, where the id parameter is passed to a database query without proper sanitization. Authenticated attackers can manipulate this parameter remotely to inject arbitrary SQL statements. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output). The exploit details have been publicly disclosed through VulDB and the project's GitHub issue tracker, increasing the likelihood of opportunistic exploitation against exposed deployments.

Critical Impact
Remote authenticated attackers can inject SQL statements through the id parameter in article_dodel.php, potentially exposing or modifying database content in native-php-cms 1.0.

Affected Products

Fanli2012 native-php-cms 1.0
Component: /fladmin/article_dodel.php
CPE: cpe:2.3:a:native-php-cms_project:native-php-cms:1.0:*:*:*:*:*:*:*

Discovery Timeline

2025-01-15 - CVE-2025-0490 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0490

Vulnerability Analysis

The vulnerability exists in the administrative article deletion handler at /fladmin/article_dodel.php. The script accepts an id parameter from the HTTP request and incorporates it directly into a SQL query used to delete an article record. Because the value is not validated, escaped, or bound through a parameterized statement, an attacker controlling the id argument can break out of the intended query context and append arbitrary SQL clauses.

The EPSS score is 0.555%, indicating measurable but not high near-term exploitation probability. However, public disclosure of the exploit through VulDB and GitHub raises the practical risk for any internet-facing installation.

Root Cause

The root cause is improper neutralization of user-supplied input in a database query construction path (CWE-74). The article_dodel.php endpoint concatenates the id request parameter into the SQL statement instead of using prepared statements with bound parameters. PHP's mysqli or PDO parameter binding is not applied, leaving the query syntax exposed to manipulation.

Attack Vector

The attack is conducted over the network against the administrative interface. According to the CVSS 4.0 vector, the attacker requires low-level privileges, meaning authentication to the /fladmin/ admin area is needed before invoking the vulnerable endpoint. Once authenticated, an attacker submits crafted values to the id parameter, such as union-based or boolean-based payloads, to extract data or alter database state. No user interaction is required.

No verified proof-of-concept code is republished here. Refer to the Fanli2012 native-php-cms GitHub Issue #12 and the VulDB entry #291935 for technical details.

Detection Methods for CVE-2025-0490

Indicators of Compromise

Web server access log entries containing requests to /fladmin/article_dodel.php with SQL metacharacters in the id parameter (single quotes, UNION, SELECT, --, 0x hex sequences).
Database error messages or HTTP 500 responses correlated with requests to article_dodel.php.
Unexpected deletion or modification of records in the article table outside of legitimate admin sessions.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects requests to /fladmin/article_dodel.php and blocks non-integer values in the id parameter.
Enable database query logging on the backend MySQL instance and alert on queries against the article table containing tautologies such as OR 1=1 or UNION SELECT.
Correlate authentication events to /fladmin/ with subsequent anomalous query volumes from the same session.

Monitoring Recommendations

Continuously monitor administrative endpoints for parameter tampering patterns and brute-force authentication attempts.
Forward web server, PHP error, and MySQL general query logs to a centralized analytics platform for retrospective hunting.
Track outbound connections from the web server host, which may indicate post-exploitation data exfiltration.

How to Mitigate CVE-2025-0490

Immediate Actions Required

Restrict access to the /fladmin/ administrative path using IP allow-listing or VPN-only access until a fix is available.
Rotate administrator credentials and audit account activity for unauthorized logins to the CMS.
Review the article and related tables for unauthorized deletions or modifications.

Patch Information

At the time of NVD publication, no official patched release of Fanli2012 native-php-cms was identified. Track the upstream GitHub issue for vendor remediation status. Organizations should consider migrating away from this CMS if no maintained fork addresses the issue.

Workarounds

Apply a virtual patch via WAF that enforces id as a numeric integer for requests to article_dodel.php.
Modify the source to use parameterized queries with PDO prepare() and bindParam(), replacing string concatenation in article_dodel.php.
Enforce least-privilege on the MySQL account used by the CMS so it cannot execute DROP, ALTER, or cross-database queries.

bash

# Example WAF rule (ModSecurity) to enforce integer-only id parameter
SecRule REQUEST_URI "@beginsWith /fladmin/article_dodel.php" \
    "chain,phase:2,deny,status:400,id:1000490,msg:'CVE-2025-0490 SQLi attempt'"
    SecRule ARGS:id "!@rx ^[0-9]+$" "t:none"