CVE-2025-14285

Executive Summary

CVE-2025-14285 is an unauthenticated SQL injection vulnerability in version 1.0 of the code-projects Employee Profile Management System, specifically in the file edit_personnel.php via the per_id argument. The flaw carries a CVSS v3.1 base score of 7.3 (High) and is exploitable remotely with no authentication or user interaction required. A public exploit exists, making this a realistic target for opportunistic scanning and automated mass-exploitation attempts against internet-facing HR and personnel management portals.

Technical Analysis

The vulnerability resides within the code-projects Employee Profile Management System 1.0, a PHP-based web application used to manage employee personnel records. Per the CNA title and NVD description, the affected component is the script edit_personnel.php, and the vulnerable input vector is the per_id argument. The NVD entry explicitly notes that "the manipulation of the argument per_id results in sql injection."

The root cause is the classic failure to perform parameterized query construction or input sanitization. User-supplied data in the per_id HTTP parameter is concatenated directly into a backend SQL statement that executes against the application's database. Because the application does not validate, type-cast, or otherwise sanitize the input, an attacker can inject SQL syntax that alters the intended query logic.

Mapping to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e. "Injection") is consistent with the NVD data provided, although the more precise descendant classification would be CWE-89 (SQL Injection). The provided intelligence explicitly lists CWE-74, so the classification is reported as supplied.

The attack surface is the web endpoint exposing edit_personnel.php. The parameter per_id is passed via an HTTP request. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is remotely reachable, requires no privileges, and needs no user interaction. The sub-score ratings of C:L/I:L/A:L indicate a partial loss of confidentiality, integrity, and availability — consistent with an injection that can read, modify, or disrupt database-backed employee records but does not by itself grant full system compromise.

No specific function names, database abstraction classes, or query strings are disclosed in the NVD description or CNA title. Any claim about exact SQL statement construction (e.g., SELECT ... WHERE id = $per_id) would be speculative and is deliberately omitted here. The defensible technical fact is that edit_personnel.php passes the unsanitized per_id parameter into a SQL query, producing an injection condition.

The public availability of an exploit ("The exploit has been made public and could be used") significantly elevates operational risk. While the EPSS score is low (0.00387, 30.7th percentile), the existence of public exploit code frequently correlates with accelerated scanning activity. No CISA KEV listing is present, indicating no confirmed exploitation in the wild at the time of assessment, but the low patch confidence (0/4) means defenders cannot rely on a vendor fix.

Exploitation Scenarios

The following attack chain describes exploitation strictly at the vulnerability-class level, grounded in the NVD description and CNA title. No public Nuclei template or packaged exploit code was provided in the dataset; however, the NVD description states a public exploit is available.

1. Reconnaissance / Target Identification. An attacker performs internet-wide reconnaissance for internet-facing instances of the code-projects Employee Profile Management System 1.0. This is typically done with Shodan or by directly requesting the known path edit_personnel.php and observing the application's fingerprint (login pages, branding, or default file presence). Because the application is a publicly distributed code-projects project, small businesses and internal HR deployments are the primary exposures.

2. Triggering the Flaw Class. The attacker sends an HTTP request to the edit_personnel.php endpoint containing a crafted value in the per_id parameter. Because the application does not sanitize or parameterize this input, injected SQL metacharacters are interpreted as SQL logic rather than literal data. This is the defining SQL injection condition — the boundary between data and executable SQL is broken.

3. Payload / Execution (Class-Level). At the vulnerability-class level, the attacker manipulates per_id to alter the query's WHERE clause logic (e.g., using tautology or UNION-based constructs) to bypass expected record boundaries, extract data from the database, or modify records. The exact payload structure depends on the backend database engine (MySQL is common for PHP/MySQL code-projects applications), which is not specified in the supplied data and is therefore not asserted here. The attacker does not need any valid account, because PR:N and UI:N indicate the request can be issued anonymously.

4. Post-Exploitation Impact. Successful exploitation gives the attacker database-level access consistent with the CVSS subscores (C:L/I:L/A:L): partial read of employee PII, partial modification of personnel records, and potential disruption of availability. Employee Profile Management Systems typically store names, addresses, national IDs, salaries, and contact details. Data exfiltration of this nature can trigger privacy regulation obligations (GDPR, CCPA) and enable downstream social engineering. If the database account is over-privileged, the attacker could potentially abuse DBMS features to reach the host, although that escalation is not established by the supplied data.

Impact Assessment

The CVSS v3.1 base score of 7.3 (High) reflects remote, unauthenticated, interaction-free exploitation with scope unchanged. The specific subscores are:

• Confidentiality (Low): Partial exposure of employee records via unauthorized data reads.
• Integrity (Low): Ability to modify personnel records through the same injection primitive.
• Availability (Low): Potential to disrupt the application or its data store.

Affected systems: Any deployment of code-projects Employee Profile Management System 1.0 exposed to a network, particularly internet-facing HR portals. Internal-only deployments are at lower but non-zero risk from insider or lateral-movement attackers.

Blast radius: The immediate blast radius is the application database backend — employee PII, credential material if stored, and organizational records. Because this class of application often shares a database server with other small business applications, compromise of a single over-privileged DB account could affect co-hosted data. The lack of any patch means every 1.0 deployment remains exposed indefinitely.

Regulatory and business impact: Exfiltration of personnel data implicates data protection regulations. Record tampering can cause payroll, compliance, and legal discrepancies. Reputational damage is amplified for managed service providers hosting the application for multiple clients.

No confirmed in-the-wild exploitation is indicated (no CISA KEV entry), and EPSS is low (0.00387). However, the public exploit and 0/4 patch confidence create a durable, unpatchable exposure for defenders who cannot remove or retire the application.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt Against edit_personnel.php (CVE-2025-14285)
id: 8f3c2b1a-4d5e-4f6a-9b7c-2e1d0f9a8b7c
status: experimental
description: Detects SQL injection attempts targeting the per_id parameter in edit_personnel.php of code-projects Employee Profile Management System 1.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-14285
author: valtersit.com
date: 2025-01-01
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection_endpoint:
    cs-uri-stem|contains: 'edit_personnel.php'
  selection_payload:
    cs-uri-query|contains:
      - 'per_id='
  selection_sqli:
    cs-uri-query|contains:
      - 'UNION'
      - 'SELECT'
      - 'OR 1=1'
      - 'OR%201=1'
      - "'"
      - '--'
      - '/*'
      - 'SLEEP('
      - 'BENCHMARK('
      - 'information_schema'
  condition: selection_endpoint and selection_payload and selection_sqli
falsepositives:
  - Legitimate administrative tools that submit structured values (validate allow-listing)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2025.14285

YARA Rule

rule CVE_2025_14285_SQLi_edit_personnel
{
    meta:
        description = "Detects SQL injection payloads targeting per_id in edit_personnel.php (CVE-2025-14285)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14285"
        date = "2025-01-01"
        severity = "high"

    strings:
        $endpoint = "edit_personnel.php" ascii nocase
        $param    = "per_id=" ascii nocase
        $sqli1    = "UNION SELECT" ascii nocase
        $sqli2    = "OR 1=1" ascii nocase
        $sqli3    = "information_schema" ascii nocase
        $sqli4    = "SLEEP(" ascii nocase
        $sqli5    = "BENCHMARK(" ascii nocase
        $comment  = "--" ascii

    condition:
        $endpoint and $param and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-14285 SQL Injection in edit_personnel.php per_id parameter"; flow:established,to_server; http.uri; content:"edit_personnel.php"; http.uri; content:"per_id="; nocase; pcre:"/per_id=[^&]*(union[\s\+]+select|or[\s\+]+1=1|information_schema|sleep\(|benchmark\()/iU"; reference:cve,2025-14285; reference:url,nvd.nist.gov/vuln/detail/CVE-2025-14285; classtype:web-application-attack; sid:90014285; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where network.protocol == "http"
      and url.path : "*/edit_personnel.php"
      and url.query : "per_id=*" ]
  [ network where network.protocol == "http"
      and url.path : "*/edit_personnel.php"
      and url.query regex ".*(union.*select|or\\s+1=1|information_schema|sleep\\(|benchmark\\()).*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=apache_access
| eval uri = uri_path + "?" + uri_query
| where match(lower(uri), "edit_personnel\.php") AND match(lower(uri), "per_id=")
| where match(lower(uri), "(union.{1,10}select|or\s+1\s*=\s*1|information_schema|sleep\(|benchmark\(|--|\/\*)")
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src_ips values(uri) as payloads by host
| sort - count

Wazuh OSSEC Rule

<group name="web,sql_injection,cve-2025-14285,">
  <rule id="100825" level="12">
    <if_sid>31100</if_sid>
    <decoded_as>web-accesslog</decoded_as>
    <url>edit_personnel\.php</url>
    <match>per_id=</match>
    <regex>(?i)(union[\s\+]+select|or[\s\+]+1\s*=\s*1|information_schema|sleep\(|benchmark\()</regex>
    <description>CVE-2025-14285: SQL injection attempt against edit_personnel.php per_id parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,web_attack,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

There is currently no vendor-supplied fix, workaround, or advisory for CVE-2025-14285. All deployments of Employee Profile Management System 1.0 should be treated as exposed until they are isolated or replaced.

1. Immediate mitigations (compensating controls):

• Block or restrict internet exposure of edit_personnel.php and the entire Employee Profile Management System at the perimeter firewall or WAF. Only trusted administrative networks should reach it.
• Deploy a WAF rule that inspects the per_id parameter for SQL metacharacters and known injection patterns; map to the Suricata/Sigma signatures above.
• Enforce input allow-listing at the reverse proxy or ingress layer, rejecting any per_id value that is not a simple integer.
• Apply least-privilege to the application's database account (read/write limited to the application schema only) to limit exfiltration and tampering scope.
• Place the application behind authentication/SSO if it is currently publicly reachable.

2. Patch / upgrade steps:

• No patch exists. Contact the code-projects maintainer/upstream project for a fixed release and monitor the project repository.
• Because no fixed version is available, the only reliable remediation is to retire or replace the application with a maintained alternative, or to manually remediate the source: convert all SQL in edit_personnel.php to parameterized/prepared statements, type-cast per_id to an integer, and add input validation. Any custom fix should be tracked as an internal fork since it will not be backed by the vendor.
• Re-validate the database contents for tampering and rotate database credentials after any suspected exposure.

3. Long-term hardening:

• Mandate secure coding standards (OWASP ASVS) requiring parameterized queries and server-side input validation across all personnel-management applications.
• Inventory and phase out unmaintained open-source web applications; track CVE exposure per deployment.
• Implement continuous vulnerability scanning and monitor threat feeds for exploit activity against this endpoint.
• Enforce database activity monitoring to detect anomalous SELECT/UNION patterns originating from the web tier.
• Maintain egress filtering to prevent data exfiltration if the application is fully compromised.

References

• NVD — CVE-2025-14285: https://nvd.nist.gov/vuln/detail/CVE-2025-14285
• MITRE CWE-74 (Injection): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• EPSS score (FIRST): https://api.first.org/data/v1/epss?cve=CVE-2025-14285
• code-projects Employee Profile Management System project page (upstream source for version tracking and any future fix): publicly distributed code-projects PHP application repository

Note: No CISA KEV entry exists for this CVE, and no named threat actor campaign or confirmed in-the-wild exploitation is documented in the supplied intelligence. The NVD description states that the exploit "has been made public and could be used," but no specific exploit code or Nuclei template was provided in this dataset.