CVE-2025-2831: Medium SQL Injection in mingyuefusu Library System

CVE-2025-2831 is a medium severity (CVSS 6.3) SQL injection flaw in the mingyuefusu tushuguanlixitong library management system. The condition argument of /admin/bookList?page=1&limit=10 (function getBookList) is passed into a database query unsafely. The record names no fixed release, so limit exposure of the admin area, apply a code-level fix if you maintain the app, and watch the vendor.

What's affected

The record lists the mingyuefusu tushuguanlixitong library management system up to commit d4836f6b49cd0ac79a4021b15ce99ff7229d4694 as affected. It is a library management project, and the record identifies versions by commit rather than release number.

The NVD description says the flaw sits in /admin/bookList?page=1&limit=10 (function getBookList) and that the condition argument is the injection point. It says the attack can be started remotely and that the exploit has been disclosed to the public. The record does not name a patch.

Severity in the record: medium, CVSS 6.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Weakness classes: CWE-74 (Injection), CWE-89 (SQL injection).

How to check if you're exposed

There is no package version to query, so exposure is a question of whether you run this application at all.

1. Search your asset inventory, hosting accounts and internal wiki for the mingyuefusu tushuguanlixitong library management system.
2. If you find an install, look for the file /admin/bookList?page=1&limit=10 (function getBookList) in the web root. Its presence on a reachable server means you run the affected code path.
3. Check your web server access logs for requests to that file from addresses you do not recognise, and for unusually long or odd parameter values.
4. Confirm whether the application is reachable from the internet or only from an internal network.

You can also run a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries your own applications pull in, though a standalone application like this one is usually found by asset inventory rather than by a package manifest.

What to do now

1. Decide whether the mingyuefusu tushuguanlixitong library management system still needs to run. Small standalone projects like this are often installed once and forgotten, and removing one you no longer use is the cleanest fix.
2. Take the admin area off the public internet. Put it behind a VPN, an IP allow list or HTTP authentication at the web server.
3. If you maintain the code, change the query behind condition to use prepared statements with bound parameters, and validate the value as the type the page expects.
4. Run the application database account with the least privilege it needs, so a successful injection cannot read or change unrelated tables.
5. Add a web application firewall rule or request filter as a stopgap, and log blocked attempts.
6. Check the vendor or project page and the references below for a fixed release, and update as soon as one is named.

Why it matters

SQL injection (CWE-89) happens when user input is placed into a query string instead of being passed as a bound parameter. The database cannot tell where the developer's query ends and the attacker's input begins, so crafted input can change what the query does. The related class CWE-74 covers injection in general: data from outside is treated as part of a command.

The scoring here is moderate rather than extreme because the vector shows low impact on confidentiality, integrity and availability, but it needs no login and no user interaction. For a small application that holds personal or business records, even low impact on each axis adds up. Public disclosure of the issue also means scanners can look for it.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Quick check

Sources

• https://gitee.com/mingyuefusu/tushuguanlixitong/issues/IBTSJL
• https://vuldb.com/?id.301468
• Safeguard Gold entry for CVE-2025-2831

Last reviewed: 19 October 2026.