CVE-2025-30570 describes an SQL Injection vulnerability in the AliRezaMohammadi product دکمه، شبکه اجتماعی خرید (dokme) affecting versions up to 2.0.6. The vulnerability arises from improper neutralization of special elements in SQL commands, potentially allowing an attacker with high privileges to execute unauthorized SQL queries. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with high confidentiality impact and low availability impact. No patches or vendor advisories are currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected application to trusted users only, apply principle of least privilege, and monitor for unusual database activity. Avoid exposing the vulnerable service to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.