CVE-2025-14245

HIGH

ideacms < 1.8 - SQL Injection via Coupon.php whereRaw Function

Title source: llm
STIX 2.1

Description

A vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file app/common/logic/index/Coupon.php. Such manipulation of the argument params leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.334755
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.334755
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.702437
Exploit, Issue Tracking, Third Party Advisory exploit issue-tracking
https://github.com/rassec2/dbcve/issues/17

Scores

CVSS v3 7.3
EPSS 0.0033
EPSS Percentile 24.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
ideacms/ideacms < 1.8
Published Dec 08, 2025
Tracked Since Feb 18, 2026