CVE-2025-51667

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-51667
An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7. The /sys-api/role/update interface in the simple-admin-core system has a limited SQL injection vulnerability, which may lead to partial data leakage or disruption of normal system operations.

7.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://gist.github.com/66Giraffe66/fc258f7fcc65a6a1a1a01e217977b92d Third Party Advisory
https://github.com/suyuan32/simple-admin-core/issues/333 Exploit Patch Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ryansu:simple_admin:*:*:*:*:*:*:*:*
History

09 Sep 2025, 15:46

Type Values Removed Values Added
First Time Ryansu
Ryansu simple Admin
CPE cpe:2.3:a:ryansu:simple_admin:*:*:*:*:*:*:*:*
References () https://gist.github.com/66Giraffe66/fc258f7fcc65a6a1a1a01e217977b92d - () https://gist.github.com/66Giraffe66/fc258f7fcc65a6a1a1a01e217977b92d - Third Party Advisory
References () https://github.com/suyuan32/simple-admin-core/issues/333 - () https://github.com/suyuan32/simple-admin-core/issues/333 - Exploit, Patch, Issue Tracking, Vendor Advisory

29 Aug 2025, 16:24

Type Values Removed Values Added
Summary
  • (es) Se detectó un problema en simple-admin-core v1.2.0 a v1.6.7. La interfaz /sys-api/role/update del sistema simple-admin-core presenta una vulnerabilidad limitada de inyección SQL, que puede provocar una fuga parcial de datos o la interrupción del funcionamiento normal del sistema.

27 Aug 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-27 18:15

Updated : 2025-09-09 15:46

NVD link : CVE-2025-51667

Mitre link : CVE-2025-51667

CVE.ORG link : CVE-2025-51667

JSON object : View

Products Affected

ryansu

  • simple_admin
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')