CVE-2025-22964 PoC — DDSN Interactive cm3 Acora CMS 安全漏洞

Source

https://github.com/padayali-JD/CVE-2025-22964

Associated Vulnerability

Title:DDSN Interactive cm3 Acora CMS 安全漏洞 (CVE-2025-22964)
Description:DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly incorporating user-supplied input into database queries without proper escaping or validation. Exploiting this issue enables unauthorized access, manipulation of data, or exposure of sensitive information, posing significant risks to the integrity and confidentiality of the application.

Readme

# CVE-2025-22964: Time-based blind SQL injection in DDSN Interactive cm3 Acora CMS version 10.1.1

DDSN Interactive cm3 Acora CMS version 10.1.1 has a time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly incorporating user-supplied input into database queries without proper escaping or validation. Exploiting this issue enables unauthorized access, manipulation of data, or exposure of sensitive information, posing significant risks to the integrity and confidentiality of the application.

Affected version: Acora CMS v10.1.1 and possibly other versions

Discovered by Joby Y Daniel, December-2024.

File Snapshot


 [4.0K]  /data/pocs/baeb04e78f2e25d6932c67e0163126f9a81e1158
└── [ 748]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!