Vulnerability · Published Jun 27, 2025 · Assigned by VulDB
CVE-2025-6753huija bicycleSharingServer AdminController.java selectAdminByNameLike sql injection
Medium 6.3
In plain English
A medium-severity SQL injection in bicycleSharingServer from huija. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 78.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in huija bicycleSharingServer 1.0 and classified as critical. This issue affects the function selectAdminByNameLike of the file AdminController.java. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| huija | bicycleSharingServer | 1.0 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-314051 | huija bicycleSharingServer AdminController.java selectAdminByNameLike sql injection vdb-entry, technical-description
- VDB-314051 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #597982 | huija bicycleSharingServer v1.0 SQL Injection third-party-advisory
- https://github.com/huija/bicycleSharingServer/issues/4 exploit, issue-tracking