CVE-2025-13121

Vulnerability

Description

In cameasy Liketea version 1.0.0, the list method in laravel/app/Http/Controllers/Front/StoreController.php suffers from a SQL injection vulnerability. The lng and lat parameters, received via a POST request, are directly interpolated into a raw SQL query using selectRaw without any sanitization or parameterization [1]. This allows an attacker to inject malicious SQL code.

Exploitation

The vulnerable endpoint is /api/v1/front/store/list and requires no authentication. An attacker can send a crafted JSON payload with malicious values for lng or lat to achieve SQL injection. The public proof-of-concept demonstrates using sqlmap to extract database information such as the version, table names, and user credentials [1].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary SQL commands against the backend database. This can lead to exfiltration of sensitive data (e.g., user emails and types), modification of data, or potential full database compromise [1].

Mitigation

No official patch has been released. The recommended remediation is to validate and sanitize inputs using floatval() or similar functions, and to use parameterized queries to prevent SQL injection [1].