{"id":"CVE-2025-5170","state":"PUBLISHED","title":"llisoft MTA Maita Training System AdminShitiController.java AdminShitiListRequestVo sql injection","description":"A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShitiListRequestVo of the file com\\llisoft\\controller\\admin\\shiti\\AdminShitiController.java. The manipulation of the argument stTypeIds leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-05-26T05:00:10.873Z","updatedAt":"2025-05-28T17:36:42.674Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["llisoft MTA Maita Training System"],"affected":[{"vendor":"llisoft","product":"MTA Maita Training System","versions":[{"version":"4.5","status":"affected"}]}],"references":["https://vuldb.com/?id.310258","https://vuldb.com/?ctiid.310258","https://vuldb.com/?submit.579069","https://wx.mail.qq.com/s?k=oVXdxVkeZQAlUQwVe2"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/5xxx/CVE-2025-5170.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-5170","state":"PUBLISHED","datePublished":"2025-05-26T05:00:10.873Z","dateUpdated":"2025-05-28T17:36:42.674Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-05-25T13:23:53.823Z"},"containers":{"cna":{"title":"llisoft MTA Maita Training System AdminShitiController.java AdminShitiListRequestVo sql injection","descriptions":[{"lang":"en","value":"A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShitiListRequestVo of the file com\\llisoft\\controller\\admin\\shiti\\AdminShitiController.java. The manipulation of the argument stTypeIds leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"In llisoft MTA Maita Training System 4.5 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Dabei geht es um die Funktion AdminShitiListRequestVo der Datei com\\llisoft\\controller\\admin\\shiti\\AdminShitiController.java. Durch die Manipulation des Arguments stTypeIds mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"llisoft","product":"MTA Maita Training System","versions":[{"version":"4.5","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.310258","name":"VDB-310258 | llisoft MTA Maita Training System AdminShitiController.java AdminShitiListRequestVo sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.310258","name":"VDB-310258 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.579069","name":"Submit #579069 | MTA Maita Training System v4.5 SQL Injection Vulnerability","tags":["third-party-advisory"]},{"url":"https://wx.mail.qq.com/s?k=oVXdxVkeZQAlUQwVe2","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-05-26T05:00:10.873Z"},"timeline":[{"time":"2025-05-25T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-05-25T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-05-25T15:29:05.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"caichaoxiong (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-27T17:45:32.142746Z","id":"CVE-2025-5170","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-28T17:36:42.674Z"}}]}}}