CVE-2025-22992
Published: 06 February 2025
Description
A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project >= 11.6.9. The vulnerability is caused by improper handling of user-supplied input in the data query parameter, allowing attackers to execute arbitrary SQL commands under specific conditions.
Security Summary
CVE-2025-22992 is a SQL injection vulnerability affecting the Emoncms project in versions greater than or equal to 11.6.9. The issue resides in the /feed/insert.json endpoint, where improper handling of user-supplied input in the data query parameter enables attackers to execute arbitrary SQL commands under specific conditions. This flaw is classified under CWE-89 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation.
The vulnerability can be exploited by unauthenticated remote attackers with network access, requiring low complexity and no user interaction. Successful exploitation allows execution of arbitrary SQL commands, potentially granting high levels of confidentiality, integrity, and availability impacts, such as data exfiltration, modification, or denial of service on the underlying database.
Mitigation details and further information are available in the referenced advisory at https://github.com/emoncms/emoncms/issues/1916.
Details
- CWE(s)