CVE-2025-4728 is a high severity SQL injection flaw (CVSS 7.3) in SourceCodester Best Online News Portal 1.0.. The searchtitle parameter in /search.php reaches a database query without safe handling. No fixed release is confirmed in the sources, so restrict access to the app and fix the query.
What's affected
The record lists SourceCodester Best Online News Portal version 1.0.. Best Online News Portal is a PHP news portal application. The weak spot is the file /search.php, and the parameter named in the record is searchtitle.
The record does not name a fixed version. The reference list holds a public issue report and the vendor homepage, and neither one, as far as the record shows, points to a patched release. Treat every copy of version 1.0. as affected until the vendor says otherwise, and check the vendor site for a newer download before you rely on this post.
How to check if you're exposed
Start by finding out whether you run this application at all. These apps are often installed once by one person and then forgotten, so look at web roots, not only at your asset list.
find /var/www -name "search.php" 2>/dev/null
grep -rn "searchtitle" --include="search.php" /var/www 2>/dev/null
Then look at who can reach it. If the web server is open to the internet, assume the flaw is reachable. The public report that accompanies the CVE says no login is needed to reach the vulnerable code, which matches the record, where privileges required is set to none.
Check your access logs for requests to the file. Unusual values in the searchtitle parameter, very long values, or a burst of requests from one address are worth a closer look.
grep -c "search.php" /var/log/nginx/access.log
Adjust the log path to your server. If you cannot tell, open the file and see whether the parameter is placed straight into a query string.
What to do now
- Find every copy of Best Online News Portal 1.0. that you run, including test and staging copies.
- Take the app off the public internet. Put it behind a VPN, an IP allowlist or a login at the web server.
- Check the vendor site for a newer release and read its notes. If none exists, plan to fix the code yourself or retire the app.
- Change the query in
/search.phpto use prepared statements with bound parameters, and validate the type ofsearchtitle. - Give the database account used by the app only the rights it needs, and rotate its password if you saw suspicious requests.
- Review the logs and the database for changes you did not make.
Why it matters
The record maps this to CWE-89, SQL injection, and the parent class CWE-74, injection. The cause is the oldest one in web security: a value from the request is joined to a SQL statement as text, so the database cannot tell data from instructions. Prepared statements keep the two apart.
The score of 7.3 reflects a network attack that needs no account and no user action, with limited impact on confidentiality, integrity and availability. That is a real risk for any app that stores visitor, customer or student records. The record says the exploit has been disclosed to the public. This CVE is not on the CISA Known Exploited Vulnerabilities list, and nothing here says it is exploited in the wild.
Many apps of this kind carry several flaws of the same shape, because the same coding habit repeats across files. Fixing one parameter and leaving the rest is a weak answer. Search the whole code base for queries built from request values.
Try it yourself
This demo shows how a scan finds flaws like this one in code or in a running app.
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version of Best Online News Portal?
The record and the public report do not name one. Check the vendor site for a newer release, and treat version 1.0. as affected until you confirm a fix.
Is CVE-2025-4728 being exploited in the wild?
The record says the exploit has been disclosed publicly, but the CVE is not in the CISA Known Exploited Vulnerabilities list. Treat it as likely to be tried against any exposed copy.
If you want a fast look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan lists known issues in a manifest, and the Gold directory has a page for each CVE.
Sources
Last reviewed: 18 October 2026.
