CVE-2025-29180

Summary

CVE-2025-29180 is a time-based blind SQL injection vulnerability affecting FOXCMS versions below 1.25. The installdb.php file fails to filter input from the url_prefix, domain, and my_website POST parameters, which are directly incorporated into SQL statements. An attacker can exploit this flaw by crafting malicious input to inject and execute SQL queries, potentially gaining unauthorized access to sensitive data or causing other types of damage. This issue poses a serious risk to FOXCMS users and requires immediate patching to mitigate the threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.