CVE-2025-2831

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vulnerability affects the function getBookList of the file /admin/bookList?page=1&limit=10. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
mingyuefusu 明月复苏	tushuguanlixitong 图书管理系统	d4836f6b49cd0ac79a4021b15ce99ff7229d4694

References

https://gitee.com/mingyuefusu/tushuguanlixitong/issues/IBTSJLExploit, Issue Tracking
https://vuldb.com/?ctiid.301468Permissions Required, VDB Entry
https://vuldb.com/?id.301468Third Party Advisory, VDB Entry
https://vuldb.com/?submit.521458Third Party Advisory, VDB Entry
https://gitee.com/mingyuefusu/tushuguanlixitong/issues/IBTSJLExploit, Issue Tracking

Timeline

Published: Mar 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-28324.3A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as prob CVE-2025-28335.3A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the co CVE-2025-283437.5striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function ThreadReadButtons.CVE-2025-283447.5striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function AuxJack.CVE-2025-28354.3A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the funct CVE-2025-283546.5An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal CVE-2025-283554.7Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF) allowing attackers to execute arbitrary code an CVE-2025-283578.8A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP CVE-2025-28366.4The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored C CVE-2025-283617.5Unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH v.1.1.4 allows a remote attacker to obtain sensitive information via the CVE-2025-283676.5mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can explo CVE-2025-28378.8Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows netwo