CVE-2025-55472
BaseFortify
Publication date: 2025-09-02
Last updated on: 2025-09-11
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tirreno | tirreno | 0.9.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-55472 is a Blind SQL Injection vulnerability in Tirreno version 0.9.5, specifically in the /admin/loadUsers API endpoint. It occurs because user-supplied input in the columns[0][data] parameter is directly used in SQL queries without proper validation or sanitization. Attackers can inject arbitrary SQL expressions into the ORDER BY clause, which does not return direct database errors but allows data extraction by observing application behavior such as response delays. For example, attackers can use time-based techniques like PostgreSQL's pg_sleep() function to infer database information, enumerate users, roles, and permissions, and potentially steal or modify sensitive data. [1]
How can this vulnerability impact me? :
This vulnerability can allow authenticated attackers who have both CSRF and session tokens to execute malicious SQL queries via AJAX requests in the Tirreno application. Exploitation can lead to unauthorized data access, including enumeration of user accounts, roles, and permissions, as well as potential data theft or modification. Because it is a blind SQL injection, attackers can extract sensitive information one character at a time by observing application response delays, posing a high-severity risk to data confidentiality and integrity. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /admin/loadUsers API endpoint for blind SQL injection in the columns[0][data] parameter. Since it is a blind SQL injection, detection involves sending crafted payloads that cause time delays in the response, such as using PostgreSQL's pg_sleep() function. For example, you can send an HTTP request with a payload that triggers a delay if a certain condition is true, and observe if the response time increases accordingly. A sample approach is to use curl or similar tools to send requests with payloads that inject time delays, then measure response times to confirm injection. Specific commands might include curl commands with injected parameters in the columns[0][data] field to test for time-based blind SQL injection. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the security patch released in Tirreno version 0.9.6, which addresses this vulnerability. Additionally, ensure that all SQL queries, especially those involving user-supplied sorting parameters, use parameterized queries or prepared statements. Implement server-side whitelisting of allowable columns and sort directions (ASC/DESC) to prevent arbitrary input. Use database driver escaping functions or security middleware libraries (e.g., sqlstring for Node.js or psycopg2.sql for Python) to safely construct SQL queries. Restrict access to the /admin/loadUsers endpoint to authenticated users with valid CSRF and session tokens to reduce exploitation risk. [1, 2]