CVE-2025-59431
BaseFortify
Publication date: 2025-09-19
Last updated on: 2025-10-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| osgeo | mapserver | 8.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-59431 is a high-severity Boolean-based SQL injection vulnerability in MapServer version 8.4.0 affecting the XML Filter Query's PropertyName directive in the Web Feature Service (WFS). Attackers can bypass expression checks by inserting double quote characters into the PropertyName field, allowing them to manipulate backend SQL database queries. This enables unauthorized access or manipulation of data by injecting malicious SQL code through crafted XML requests. The vulnerability is fixed in version 8.4.1. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass intended query filters and manipulate backend database queries, potentially leading to unauthorized data access, data leakage, or data manipulation. This could compromise the confidentiality and integrity of the data managed by MapServer, impacting any applications relying on it for GIS data services. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring or testing the WFS (Web Feature Service) XML Filter Query requests to the MapServer endpoint for suspicious PropertyName elements containing injected SQL payloads, such as double quote characters and Boolean expressions (e.g., " OR 1=1 OR "). A practical detection method is to send crafted XML queries similar to the proof-of-concept payload: <ogc:PropertyName>" OR 1=1 OR 1="</ogc:PropertyName> to the WFS endpoint and observe if unauthorized data is returned or if the query bypasses filtering logic. Network intrusion detection systems (NIDS) can also be configured to look for such patterns in XML requests. Specific commands depend on your environment, but for example, using curl to send a test XML request to the WFS endpoint can help detect the vulnerability: curl -X POST -H "Content-Type: text/xml" --data-binary @test_payload.xml https://your-mapserver/wfs where test_payload.xml contains the crafted PropertyName element with the injection payload. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade MapServer to version 8.4.1 or later, where this SQL injection vulnerability in the PropertyName directive of the XML Filter Query is fixed. Until the upgrade can be performed, restrict access to the WFS endpoint to trusted users only, implement input validation or filtering on incoming XML requests if possible, and monitor for suspicious query patterns. Additionally, consider disabling or limiting the use of the WFS service if it is not required. [1]