CVE-2025-2065 is a high severity SQL injection flaw (CVSS 7.3) in projectworlds Life Insurance Management System. The agent_id parameter handled by /editAgent.php is passed into a database query without safe handling. No fixed version is confirmed, so restrict access and review the code.
What's affected
- Product: projectworlds Life Insurance Management System
- Affected versions: 1.0
- Vulnerable file and parameter:
/editAgent.php, argumentagent_id - CVSS: 7.3 (High), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Published: 2025-03-07
Neither the record nor the pages I read name a fixed release. Check projectworlds directly for an updated build, and treat the product as unpatched until you can confirm one.
The record says the attack can be launched remotely and that the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false for this CVE. Several sibling CVEs (CVE-2025-2062 to CVE-2025-2067) cover other files in the same product, so audit the whole codebase rather than one page.
How to check if you're exposed
This is a standalone PHP application, so there is usually no package manager entry to query. Start by confirming whether you run it and which version.
# find copies of the vulnerable file on your hosts
find / -name "editAgent.php" -not -path "*/proc/*" 2>/dev/null
# see how the parameter is used in the code
grep -rn "agent_id" /var/www --include=*.php | head
If the file exists and the query is built by joining strings, treat the host as exposed. Then look at your web server or application logs for requests to this path that carry unusual quote characters or SQL keywords in agent_id. Odd requests do not prove compromise, but a clean log is useful evidence too.
If the application sits behind a login page, check who can reach it. Work out whether it is reachable from the internet or only from an internal network. You can also run a free in-browser dependency scan against any dependency manifest in the project, although it will not detect the code level weakness in this case.
What to do now
- Find every instance of Life Insurance Management System in your estate, including test and demo copies that nobody remembers.
- Check projectworlds for an updated release. If none is named, plan to patch the code yourself or retire the application.
- Change the database query behind
/editAgent.phpto use prepared statements with bound parameters instead of string concatenation. - Limit the database account the application uses. It should not own the schema or hold rights it does not need.
- Put the admin area and any login page behind a network allowlist, VPN or an extra authentication layer until the code is fixed.
- Review database contents and web logs for the period the application was reachable, and rotate any credentials stored in the database.
Why it matters
The weakness is CWE-89, SQL injection, filed with its parent class CWE-74. User input reaches a database query and changes what the query means. The usual result is that someone who should only be able to read one record can read, change or remove others.
The CVSS vector shows network access, low complexity and no privileges or user interaction. Confidentiality, integrity and availability impacts are each rated low, which is why the score is 7.3 rather than higher. Agent records likely hold contact details, so confidentiality and integrity both matter here. Small projects like this often get copied into production unchanged, and a public exploit disclosure means attackers do not need to work out the details themselves.
Quick check
Is CVE-2025-2065 exploited in the wild?
The CISA Known Exploited Vulnerabilities flag is false and none of the pages I read report active exploitation. The record does say a public exploit disclosure exists, so treat it as easy to attempt.
Does a web application firewall fix this?
It can reduce risk while you work, but it does not remove the flaw. The lasting fix is a parameterized query in the code.
Sources
Last reviewed: 19 October 2026.
