LiveActive security incident?Get immediate response
CVE Record

CVE-2014-125037: License to Kill injury.rb sql injection

A vulnerability, which was classified as critical, was found in License to Kill. This affects an unknown part of the file models/injury.rb. The manipulation of the argument name leads to sql injection. The patch is named cd11cf174f361c98e9b1b4c281aa7b77f46b5078. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217191.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

License to Kill has a SQL injection flaw in models/injury.rb tied to handling the name argument. A logged-in attacker with adjacent access could potentially read or change limited data or disrupt availability. Public sources name a patch commit, but affected versions and deployment prevalence are not specified.

Executive priority

Handle as a moderate-priority remediation. The flaw can affect confidentiality, integrity, and availability, but public evidence suggests constrained access requirements and no confirmed active exploitation. Escalate priority if this code protects sensitive data or is reachable from untrusted adjacent networks.

Technical view

CVE-2014-125037 is CWE-89 SQL injection in License to Kill. The CVSS 3.1 vector is AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, score 5.5. The vulnerable component is models/injury.rb, with manipulation of name leading to SQL injection. The referenced fix is commit cd11cf174f361c98e9b1b4c281aa7b77f46b5078.

Likely exposure

Exposure is limited to organizations running License to Kill code that includes the vulnerable models/injury.rb behavior. Sources do not provide affected version ranges, CPEs, package identifiers, or evidence of broad ecosystem deployment.

Exploitation context

No source in the bundle indicates active exploitation, and the CVE is not listed as KEV. The scoring indicates exploitation requires adjacent access and low privileges, with no user interaction. Public details identify the vulnerable argument and patch but do not establish exploit availability.

Researcher notes

Evidence is sparse: vendor is listed as n/a, versions are n/a, and CPEs are absent. Treat affected-surface analysis as code-based rather than product-version-based. Do not infer exploit maturity from the vulnerability description alone.

Mitigation direction

  • Apply the referenced upstream patch commit after normal change testing.
  • Check project guidance for any newer fixed revision or release.
  • Prioritize systems where License to Kill has sensitive database access.
  • Restrict access to affected application paths where operationally feasible.
  • Use least-privilege database permissions to reduce impact.

Validation and detection

  • Inventory whether License to Kill is deployed or vendored internally.
  • Check for models/injury.rb and pre-patch handling of the name argument.
  • Confirm commit cd11cf174f361c98e9b1b4c281aa7b77f46b5078 or equivalent fix is present.
  • Review application and database logs for suspicious name-parameter errors.
  • Validate fixes in staging without using offensive payloads.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-89: Database access and collection lookup

Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2014-125037 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L2.13.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2014-125037Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aLicense to Killn/aListed
Weakness

CWE details

CWE-89

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.