CVE-2025-15597

Katalog CVE

CVSS 6.3 · Medium EPSS 0,56%

Kerentanan Incorrect Privilege Assignment pada fit2cloud sqlbot. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.

Rincian

Terbit di NVD

2 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-284: Improper Access Control

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r exploit · advisory vendor
• https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc28c patch
• https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.md exploit · advisory pihak ketiga
• https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.md exploit · advisory pihak ketiga
• https://vuldb.com/?id.348291 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.706144 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707283 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707284 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707285 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707286 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707288 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707293 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707294 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.707295 advisory pihak ketiga · vdb entry
• https://github.com/dataease/SQLBot/ product
• https://github.com/dataease/SQLBot/releases/tag/v1.5.0 release notes
• https://vuldb.com/?ctiid.348291 permissions required · vdb entry