CVE-2025-56162: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 2 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
Given the absence of official patches, European organizations should immediately implement the following mitigations: 1) Apply strict input validation and sanitization on the goodsIds parameter to prevent injection of malicious SQL code. 2) Employ Web Application Firewalls (WAFs) with custom rules to detect and block suspicious payloads targeting the /api/goods/listByIds endpoint. 3) Restrict database user privileges to the minimum necessary, ensuring the database account used by YOSHOP cannot execute xp_cmdshell or write files to the web root. 4) Monitor logs for unusual database queries or attempts to access the vulnerable endpoint. 5) Consider temporarily disabling or restricting access to the affected API endpoint until a patch is available. 6) Conduct thorough security assessments and penetration tests focusing on SQL injection vectors in YOSHOP deployments. 7) Stay updated with vendor advisories for official patches or updates addressing this vulnerability.
Description
YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates user input into orderRaw('field(goods_id, ...)'), allowing attackers to: (a) enumerate or modify database data, including dumping admin password hashes; (b) write web-shell files or invoke xp_cmdshell, leading to remote code execution on servers configured with sufficient DB privileges.