CVE-2025-1872 is a critical SQL injection flaw in 101news 1.0, an online news portal, scored 9.8. It affects the sadminusername parameter in admin/add-subadmins.php. INCIBE-CERT reported that no solution was available when it published its advisory, so limit access to the admin area and check the vendor for updates.
What's affected
INCIBE-CERT advisory INCIBE-2025-0113 covers seven SQL injection issues in 101news version 1.0, an online news portal developed by Mayuri K and discovered by Rafael Pedrero. This CVE is one of them: the sadminusername parameter in admin/add-subadmins.php.
- Product: 101news (listed in the record as Mayurik Best Online News Portal)
- Affected: version 1.0
- Fixed: the advisory says there was no reported solution at the time it was published
- Severity: Critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). INCIBE scored the group 9.3 under CVSS v4.0.
- Known exploited (CISA KEV): no, the record's kev flag is false
The same advisory lists CVE-2025-1869 to CVE-2025-1875. If you run this portal, treat all seven as one problem rather than patching one page.
How to check if you're exposed
Use these steps.
- Find every copy of 101news in your estate, including test copies. Search web roots for the file names above, for example
find /var/www -name "add-subadmins.php". - Read the version from the project files or the original download. The advisory covers version 1.0.
- Check whether the admin folder is reachable from the internet. Your web server access log, searched for requests to admin/add-subadmins.php, shows who has called it.
- If you hold the source, find where the sadminusername value is used and see whether it is placed straight into a query string.
A dependency scan will not find this, because the flaw is in the application's own code. A code scan or a web scan of the running site covers it.
What to do now
- Take the portal off the public internet, or put the admin folder behind a VPN or an IP allow list.
- Check the vendor and the INCIBE advisory for a fixed release. The advisory reported none, so confirm before you assume otherwise.
- If you maintain the code, change the queries to use parameter binding for every input in the seven listed pages, and validate input types.
- Give the application's database user only the rights it needs.
- Review web logs and the database for unexpected requests to the listed pages and for odd changes to admin accounts.
- If the portal is no longer needed, retire it.
Why it matters
SQL injection (an injection flaw, where a value controlled by the user becomes part of a database query) lets a caller change what the database does. The CVSS vector for this record needs no privileges and no user interaction, and scores confidentiality, integrity and availability impact as high.
This page is under admin/, which suggests the affected input is part of the admin area. The record does not say whether a login is needed before the vulnerable code runs, and the vector says no privileges are required, so do not rely on the folder name for protection.
The record maps this to CWE-89 (SQL Injection).
Quick check
Is CVE-2025-1872 exploited in the wild?
The record's CISA KEV flag is false, and neither the record nor the INCIBE advisory says attacks are underway.
Is there a patch for 101news?
The INCIBE advisory said there was no reported solution at publication. Check the vendor for anything newer.
Sources
Last reviewed: 19 October 2026.
