CVE-2025-1227
Published: 12 February 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-1227 is a SQL injection vulnerability affecting ywoa versions up to 2024.07.03. The issue resides in the selectList function within the file com/cloudweb/oa/mapper/xml/AddressDao.xml. Rated as critical with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), it corresponds to CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection). The vulnerability was published on 2025-02-12.
An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By manipulating input to the affected function, the attacker can inject malicious SQL payloads, potentially leading to limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service within the scope of the low-privileged context.
Advisories recommend upgrading to ywoa version 2024.07.04, which addresses the issue. The exploit has been publicly disclosed and may be used, as noted in references including Gitee issues at https://gitee.com/r1bbit/yimioa/issues/IBI7XH and VulDB entries at https://vuldb.com/?ctiid.295217 and https://vuldb.com/?id.295217.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in public-facing web app enables initial access via public-facing application exploitation (T1190), server software component abuse (T1505 as noted in advisory), and data collection from databases (T1213.006).