CVE-2025-12465 Blind SQL Injection in QuickCMS
A high-privileged user can exploit a blind SQL injection vulnerability in QuickCMS to read sensitive database information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12465?
CVE-2025-12465 is a high-severity SQL injection vulnerability in OpenSolution QuickCMS, published on 2 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Weakness: CWE-89
Which versions are affected by CVE-2025-12465?
How do I fix CVE-2025-12465?
No fix has been published for CVE-2025-12465 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-12465 being exploited?
There is no known exploitation of CVE-2025-12465 in the wild and no public exploit code.
Sources
Also known as GHSA-fpxj-733r-46hx.