PT-2025-28306

CVE-2025-7156

Published

2025-07-08

Updated

2025-07-08

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: hitzs-ids airda version 0.0.3

Description: A critical vulnerability exists in the execute function of the /v1/chat/completions file. Manipulation of the question argument results in SQL injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations: For hitsz-ids airda version 0.0.3, avoid using the question parameter in the /v1/chat/completions API endpoint until the issue is resolved.

Exploitability

Exploit

Fix

Impacts

Researchers

Aibot888

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers