CVE-2025-15014
Unknown Unknown - Not Provided
SQL Injection in loganhong loganSite Article Handler Allows Remote Attack

Publication date: 2025-12-22

Last updated on: 2025-12-22

Assigner: VulDB

Description
A security flaw has been discovered in loganhong php loganSite up to c035fb5c3edd0b2a5e32fd4051cbbc9e61a31426. This affects an unknown function of the file /includes/article_detail.php of the component Article Handler. Performing manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-22
Last Modified
2025-12-22
Generated
2026-06-16
AI Q&A
2025-12-23
EPSS Evaluated
2026-06-15
NVD
CVE-2025-15014
EUVD
EUVD-2025-204699
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
loganhong logansite *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

CVE-2025-15014 is an SQL injection vulnerability in the PHP project loganSite, specifically in the file /includes/article_detail.php. The vulnerability occurs because the code directly concatenates the user-supplied ID parameter into an SQL query without any escaping or parameterization. This allows an attacker to manipulate the SQL query by injecting malicious input remotely, potentially executing arbitrary SQL commands on the database. [1, 2, 3]

Impact Analysis

This vulnerability can allow remote attackers to execute arbitrary SQL commands on the affected system's database. This can lead to unauthorized access to sensitive data, modification or deletion of data, and potentially compromise the confidentiality, integrity, and availability of the system. Attackers can extract sensitive information or disrupt the normal operation of the application. [2, 3]

Detection Guidance

This vulnerability can be detected by sending specially crafted HTTP GET requests to the vulnerable endpoint `/includes/article_detail.php` with manipulated `id` parameters to test for SQL injection. Tools like sqlmap or Burp Suite can be used to automate detection. For example, using sqlmap: `sqlmap -u "http://targetsite/php-master/includes/article_detail.php?id=1" --batch` can help identify the injection. Additionally, manual testing can be done by sending a request such as: `GET /php-master/includes/article_detail.php?id=-7161 UNION ALL SELECT NULL,NULL,CONCAT(0x7170707171,0x746978664a47627a6f7a62737361695a467564686d44666678624b736b6c414f594552456975546c,0x7171627071),NULL,NULL,NULL-- -` to check if the response contains injected data. [1, 2]

Mitigation Strategies

Immediate mitigation steps include avoiding the use of the vulnerable component or product until a patch is available, as no known countermeasures or mitigations have been documented. Consider replacing or removing the affected file `/includes/article_detail.php` or the entire Article Handler component. Additionally, implement input validation and parameterized queries or prepared statements to prevent SQL injection. Restrict access to the vulnerable endpoint and monitor for suspicious activity. Since the product uses a rolling release with no available patches, these steps are critical to reduce risk. [3, 1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart