CVE-2025-5432 is a medium severity (CVSS 6.3) SQL injection in AssamLook CMS 1.0. The ID argument of /view_tender.php reaches a database query without proper handling. The record says the vendor did not respond and lists no fix, so limit exposure or move off the software.
What's affected
- AssamLook CMS 1.0 is the affected version in the record.
- No fixed version is recorded. The record says the vendor was contacted early and did not respond.
The record lists CVSS 6.3 (Medium). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Look for the file view_tender.php in your web root. If it is there, you are running the affected code path.
Check your web server logs for requests to that file with unusual values in the ID parameter. Do not test it by injecting your own payloads against production.
What to do now
- Find out whether AssamLook CMS 1.0 runs anywhere in your estate.
- Put the application behind authentication or a web application firewall rule, or take it offline.
- If you maintain the code, switch the query to a parameterised statement and validate the ID as an integer.
- Plan a migration away from software with no maintainer response.
- Rotate database credentials if you see signs of tampering.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The record tags the flaw as CWE-89 and CWE-74, injection of untrusted input into a downstream query. The cure is well understood: keep data and query structure separate.
The record also states the exploit details have been disclosed publicly. It is not marked as KEV, but a public write up lowers the effort for anyone scanning for the app.
Severity scores are a starting point. The score for this entry is 6.3, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Is there a patch?
The record lists none and says the vendor did not reply. Check the project page for any newer release.
What is the quickest safe step?
Remove public access to the application until you have a fix or a replacement.
Sources
- https://github.com/YZS17/CVE/blob/main/SQL/SQLi%20in%20AssamLook%20CMS-v1.0.md
- https://vuldb.com/?ctiid.310765
- https://vuldb.com/?id.310765
Last reviewed: 18 October 2026.
