CVE-2025-65877 Details
Description
Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in com.wanli.lvzhoucms.service.ContentService#findPage. The parameter is concatenated directly into a dynamic SQL query without sanitization or prepared statements, enabling attackers to read sensitive data from the database.
A SQL injection vulnerability has been identified in Lvzhou CMS versions prior to the commit on September 22, 2025. The issue arises in the ContentService 'findPage' method, where the 'title' parameter is directly concatenated into a SQL query without proper sanitization or the use of prepared statements. This vulnerability allows attackers to manipulate the SQL query and potentially access sensitive data from the database.
It is recommended to filter the 'title' parameter thoroughly and to use prepared statements for SQL queries to prevent direct concatenation of user input into SQL commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/W000i/vuln/issues/1 | [email protected] | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| wanliofficial lvzhou cms | < 2025-09-22 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 19, 2025 | Initial Analysis | [email protected] |
| Dec 9, 2025 | CVE Modified | CISA-ADP |
| Dec 2, 2025 | CVE Modified | CISA-ADP |
| Dec 2, 2025 | New CVE Received | [email protected] |