CVE-2025-5569

MEDIUM NUCLEI

ideacms < 1.7 - SQL Injection via Article/Goods Field Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-5569 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

A vulnerability was found in IdeaCMS up to 1.7 and classified as critical. This issue affects the function Article/Goods of the file /api/v1.index.article/getList.html. The manipulation of the argument Field leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.8 is able to address this issue. The patch is named 935aceb4c21338633de6d41e13332f7b9db4fa6a. It is recommended to upgrade the affected component.

Nuclei Templates (1)

IdeaCMS <= 1.7 - SQL Injection
CRITICALVERIFIEDby ritikchaddha
Shodan: http.favicon.hash:-1033616879
FOFA: icon_hash:"-1033616879"

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.311027
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.311027
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.588372
Exploit, Issue Tracking, Vendor Advisory issue-tracking
https://gitee.com/ideacms/ideacms/issues/ICBVWE
Exploit, Issue Tracking, Vendor Advisory broken-link issue-tracking
https://gitee.com/ideacms/ideacms/issues/ICBVWE#note_42016626_link
Release Notes broken-link patch
https://gitee.com/ideacms/ideacms/releases/tag/v1.8

Scores

CVSS v3 6.3
EPSS 0.0074
EPSS Percentile 73.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
ideacms/ideacms < 1.7
Published Jun 04, 2025
Tracked Since Feb 18, 2026