CVE-2025-1873 is a critical severity SQL injection flaw (9.8) in Mayurik Best Online News Portal (published as 101news) 1.0, in the pagetitle and pagedescription input of admin/contactus.php. The record names no fixed release, so confirm with the vendor, rewrite the query with bound parameters, and restrict access to the page.
What's affected
The CVE record lists Mayurik Best Online News Portal (published as 101news), version 1.0. The weakness is classed as CWE-89. The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is rated high for confidentiality, high for integrity and high for availability. The page lives in the admin area, though the record rates it as needing no privileges.
The description says the exploit has been disclosed to the public and may be used. The record is not on the CISA Known Exploited Vulnerabilities list, and nothing I fetched says it is being exploited in the wild.
Fixed versions: none are named in the record. I could not confirm a vendor patch, so check the vendor's download page and the public report before assuming a newer release exists. Treat every copy of version 1.0 as exposed until you have changed the query yourself or upgraded to a release the vendor confirms.
How to check if you're exposed
Start with an inventory. Find every copy of the application on your servers, including old test installs and backups that still answer web requests.
find /var/www -name "contactus.php" 2>/dev/null
grep -n "pagetitle" /var/www/path/to/contactus.php
Open the match and look at how the value reaches the database. If the request value is joined into the SQL string, the code is vulnerable. If it is passed as a bound parameter to a prepared statement, that line is not the problem.
Then read your web server logs for requests to that path from addresses you do not recognize, and look for long values or unusual quote characters in that parameter.
grep "contactus.php" /var/log/apache2/access.log | less
Finally, confirm the version against the one in your download or documentation. If you cannot tell which version you run, assume version 1.0.
What to do now
- Find every deployment of Best Online News Portal (published as 101news) and note its version.
- If the app does not need to be public, take it offline or put it behind a VPN or an IP allowlist today.
- Rewrite the vulnerable query in admin/contactus.php to use prepared statements with bound parameters, using mysqli or PDO in PHP or the equivalent in your stack. Apply the same change to every other query in the file.
- Require a valid session at the top of any admin page and check the user role before the query runs.
- Give the database account used by the app only the rights it needs, so a flaw cannot drop tables or read unrelated schemas.
- Check the vendor page for an updated release and read its notes before you upgrade.
- Review logs for the period since the version went live, and rotate any passwords stored in the affected database if you find signs of misuse.
Why it matters
SQL injection happens when user input is placed into a database query as text instead of as a value. The database then cannot tell the developer's instructions from the visitor's input. It sits under CWE-89 and the broader injection family, a long-standing and well documented weakness class.
This page sits in the admin area of a news site, but the record rates it with no privileges required, so treat the admin folder as reachable until you have proof it is not. A news portal usually holds editor accounts and unpublished stories, and the same database often serves the public pages.
Small PHP and Java applications are often copied, customized and left running for years without updates. That is why the fix is rarely a patch you install. It is usually a code change you make yourself, and the same pattern often exists in other files of the same project.
Quick check
The record says two parameters are affected. Is fixing one enough?
No. Two parameters feed the same query in the same file, so patch both and then review every other place where the page reads form input. The INCIBE notice covers several flaws in this product, which suggests the code base has more than one weak spot.
Is there an official patch I can install?
The record does not name a fixed version, and I could not confirm one. Check the vendor's page. Until then, the safe path is to change the query to use bound parameters and limit who can reach the page.
Sources
- CVE-2025-1873 on Safeguard Gold
- The public report and listings linked from the CVE record (record references: reference 1)
Last reviewed: 19 October 2026.
