CVE-2025-64084
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vucc_details_ajax function in application/controllers/Awards.php does not properly sanitize the user-supplied Gridsquare POST parameter, allowing a remote authenticated attacker to execute arbitrary SQL commands by injecting a malicious payload that is concatenated into a raw SQL query in the vucc_qso_details function.
Risk Assessment
An authenticated attacker could read or modify data in the Cloudlog database. This may lead to confidentiality and integrity breaches of radio log and user account data.
Recommendation
Update Cloudlog to a version later than 2.7.5 if available, or apply a fix that sanitizes the Gridsquare parameter. Restrict application access and review user privileges.
Other vulnerabilities in Cloudlog
Original NVD description (English source)
An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vucc_details_ajax function in application/controllers/Awards.php does not properly sanitize the user-supplied Gridsquare POST parameter. This allows a remote, authenticated attacker to execute arbitrary SQL commands by injecting a malicious payload, which is then concatenated directly into a raw SQL query in the vucc_qso_details function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS