Critical Risk Disclosed
CVE-2025-55444
A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can inject arbitrary SQL queries, leading to database enumeration and potential remote code execution.
Exploitation Probability (EPSS)
Low Priority0.59%
The Exploit Prediction Scoring System (EPSS) uses machine learning to estimate the probability that a vulnerability will be exploited in the wild within the next 30 days.
0% (Theoretical)100% (Certainty)
7-Day Exploitation Trend
Vulnerability Timeline
2 eventsAug 20, 2025
Vulnerability Disclosed
Published to component-level vulnerability database.
Sep 11, 2025
Last Updated
Record updated with new analysis or tags.
Threat Actor Attribution
PREMIUM INTELAssociated Groups:Lazarus Group, APT28
Ransomware Campaigns:LockBit 3.0, BlackCat
IoCs (Indicators):14 IPs, 3 Hashes
Remediation & Mitigation
SOLUTIONOfficial patches and mitigation steps are available for this vulnerability.
# Update Command
apt-get update && apt-get upgrade -y specific-package
# Verify installation
dpkg -l | grep package-name
apt-get update && apt-get upgrade -y specific-package
# Verify installation
dpkg -l | grep package-name
Affected Products
1 Total
vishalmathur/online_artwork_and_fine_arts_project1.0
References
https://gist.github.com/Anudeepkadambala/88c6065f1de1597be96e50a573cde56eGitHub
Third Party Advisory
https://github.com/Anudeepkadambala/CVE-Reports/blob/main/CVE-2025-55444_Disclosure.mdGitHub
ExploitThird Party Advisory
https://github.com/Anudeepkadambala/CVE-Reports/security/advisories/GHSA-r4mf-mr9h-f27mGitHub
ExploitThird Party Advisory
https://github.com/mathurvishal/Online-Artwork-and-Fine-Arts-MCA-Major-ProjectGitHub
Product
Am I Vulnerable?
Check your domain or package.json for CVE-2025-55444 exposure.
Vulnerability Details
CVSS Base Score
9.8/ 10
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published Date
Aug 20, 2025
Last Modified
Sep 11, 2025
Need Manual Validation?
Automated scanners flag false positives. Get a manual pentest validation for this CVE.