CVE-2025-1389

CVE-2025-1389 is a SQL injection vulnerability (CWE-89) affecting Orca HCM, a human capital management software product from Learning Digital. Published on 2025-02-17, the flaw enables attackers to inject arbitrary SQL commands into the application, allowing them to read, modify, and delete database contents. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its network accessibility, low complexity, and significant impacts on confidentiality, integrity, and availability.

Attackers with low (regular) privileges can exploit this vulnerability remotely without requiring user interaction. Exploitation involves crafting malicious SQL inputs that execute arbitrary commands on the underlying database, potentially granting unauthorized access to sensitive data, altering records, or causing data loss across the affected system.

Advisories detailing mitigations and patches are available from TWCERT/CC at https://www.twcert.org.tw/en/cp-139-8432-4b516-2.html and https://www.twcert.org.tw/tw/cp-132-8431-61e42-1.html.