Vulnerability · Published Apr 21, 2025 · Assigned by VulDB

CVE-2025-3846markparticle WebServer Registration httprequest.cpp sql injection

High 7.3

In plain English

A high-severity SQL injection in WebServer from markparticle. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in markparticle WebServer up to 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file code/http/httprequest.cpp of the component Registration. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
markparticle	WebServer	1.0

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

VDB-305774 | markparticle WebServer Registration httprequest.cpp sql injection vdb-entry, technical-description
VDB-305774 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #556274 | markparticle WebServer 1.0 SQL Injection third-party-advisory
https://magnificent-dill-351.notion.site/SQL-Injection-of-Register-in-WebServer-1-0-1d1c693918ed80b69a0bfcd9b685de46 related
https://magnificent-dill-351.notion.site/SQL-Injection-of-Login-in-WebServer-1-0-1d1c693918ed800b847bcc28bd691b7c exploit