Cyber Posture

CVE-2025-0788

Medium

Published: 28 January 2025

Published
28 January 2025
Modified
16 May 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 20.1th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-0788 is a SQL injection vulnerability in ESAFENET CDG V5, affecting an unknown functionality within the /content_top.jsp file. The issue arises from manipulation of the "id" argument, classified under CWE-74 and CWE-89. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-28.

The vulnerability enables remote exploitation by an attacker possessing low privileges (PR:L), requiring no user interaction. Successful exploitation results in low impacts to confidentiality, integrity, and availability, allowing limited unauthorized access, modification, or disruption via SQL injection.

References, including a GitHub disclosure at https://github.com/Rain1er/report/blob/main/CDG/content_top.md and VulDB entries (https://vuldb.com/?ctiid.293912, https://vuldb.com/?id.293912, https://vuldb.com/?submit.483341), confirm the exploit has been publicly disclosed and is available for use. The vendor was contacted early regarding the issue but provided no response, with no patches or mitigations detailed in available sources.

Details

CWE(s)
CWE-74CWE-89

Affected Products

esafenet
cdg
5

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web app (/content_top.jsp) enables initial access via exploitation of public-facing application (T1190), server software component abuse for execution (T1505 as cited in advisory), and data collection from databases (T1213.006) through arbitrary SQL queries.

References