CVE-2025-59431

Katalog CVE

CVSS 9.8 · Critical EPSS 0,42%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada osgeo mapserver. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1.

Rincian

Terbit di NVD

19 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MapServer/MapServer/security/advisories/GHSA-256m-rx4h-r55w exploit · advisory vendor