CVE-2025-24787

CVE-2025-24787 is a high-severity parameter injection vulnerability affecting WhoDB, an open-source database management tool. It allows an unauthenticated attacker to read local files on the server where WhoDB is running by injecting malicious parameters into database connection strings. Specifically, by exploiting unsafe string concatenation, an attacker can enable the `allowAllFiles` option in MySQL connections, facilitating arbitrary local file disclosure. The vulnerability has a CVSS score of 7.5 (HIGH) due to its network-based attack vector, low complexity, and high confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community discussion regarding this CVE.