CVE-2025-3318
Last modified
CVE-2025-3318 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. A vulnerability classified as critical was found in Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0. Affected by this vulnerability is the function page of the file src/main/java/com/controller/ShangpinleixingController.java. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
A vulnerability classified as critical was found in Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0. Affected by this vulnerability is the function page of the file src/main/java/com/controller/ShangpinleixingController.java. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kennifrog | Company Financial Management System | 1.0 |
References
- https://gitee.com/Kenj_Frog/company-financial-management/issues/IBM6D9Exploit, Issue Tracking
- https://vuldb.com/?ctiid.303517Permissions Required, VDB Entry
- https://vuldb.com/?id.303517Third Party Advisory, VDB Entry
- https://gitee.com/Kenj_Frog/company-financial-management/issues/IBM6D9Exploit, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-3318?
How severe is CVE-2025-3318?
How do I fix CVE-2025-3318?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-3316A vulnerability was found in PHPGurukul Men Salon Management…9.8
- CVE-2025-3317A vulnerability classified as problematic has been found in …5.3
- CVE-2025-33176NVIDIA RunAI for all platforms contains a vulnerability wher…6.2
- CVE-2025-33177NVIDIA Jetson Linux and IGX OS contain a vulnerability in Nv…5.5
- CVE-2025-33178NVIDIA NeMo Framework for all platforms contains a vulnerabi…7.8
- CVE-2025-33179NVIDIA Cumulus Linux and NVOS products contain a vulnerabili…8.8
- CVE-2025-33180NVIDIA Cumulus Linux and NVOS products contain a vulnerabili…8.8
- CVE-2025-33181NVIDIA Cumulus Linux and NVOS products contain a vulnerabili…8.8
- CVE-2025-33182NVIDIA Jetson Linux contains a vulnerability in UEFI, where …7.6
- CVE-2025-33183NVIDIA Isaac-GR00T for all platforms contains a vulnerabilit…7.8
- CVE-2025-33184NVIDIA Isaac-GR00T for all platforms contains a vulnerabilit…7.8
- CVE-2025-33185NVIDIA AIStore contains a vulnerability in AuthN where an un…5.3
Are you affected by CVE-2025-3318?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST