CVE-2025-67510
BaseFortify
Publication date: 2025-12-10
Last updated on: 2026-03-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| neuron-ai | neuron | to 2.8.12 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-250 | The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Neuron PHP framework versions 2.8.11 and below, where the MySQLWriteTool executes arbitrary SQL commands provided by the caller without semantic restrictions. Because it uses PDO::prepare() and execute() without limiting the type of SQL, an attacker can manipulate prompts to execute destructive SQL queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements, depending on database permissions. This is especially risky when the tool is exposed to untrusted input or runs with a database user that has broad privileges. The issue is fixed in version 2.8.12.
How can this vulnerability impact me? :
This vulnerability can lead to severe impacts including unauthorized execution of destructive SQL commands that can delete or alter data, drop tables, or change database privileges. This can result in data loss, data corruption, unauthorized access escalation, and disruption of services relying on the database. The impact depends on the database user's privileges and exposure to untrusted input.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Neuron PHP framework to version 2.8.12 or later. Additionally, avoid exposing the MySQLWriteTool to untrusted input and ensure that the database user running the tool has limited privileges to reduce risk.