SQL Injection Vulnerability in AssamLook CMS by Assam Software
CVE-2025-5432

5.3MEDIUM

Key Information:

Vendor: Assamlook
Status: Cms
Vendor: CVE Published:; 2 June 2025

Badges

👾 Exploit Exists

What is CVE-2025-5432?

A SQL injection vulnerability has been identified in AssamLook CMS 1.0, specifically within the /view_tender.php file. This issue arises when the argument ID is manipulated, allowing attackers to execute arbitrary SQL queries against the database. The vulnerability is exploitable remotely, posing a significant risk to the confidentiality and integrity of the data managed by the CMS. Disclosures regarding the existence of this exploitation have been made publicly, yet the vendor has not issued any response or patch to mitigate the threat.

Affected Version(s)

CMS 1.0

References

https://vuldb.com/?id.310765

vdb-entrytechnical-description

https://vuldb.com/?ctiid.310765

signaturepermissions-required

https://github.com/YZS17/CVE/blob/main/SQL/SQLi%20in%20As...

exploit

CVSS V4

Score:

5.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction: