CVE-2025-67509
BaseFortify
Publication date: 2025-12-10
Last updated on: 2026-03-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| neuron-ai | neuron | to 2.8.12 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Neuron PHP framework versions 2.8.11 and below, specifically in the MySQLSelectTool component. The tool is intended to be read-only for SQL queries, but its validation only checks the first keyword and a forbidden-keyword list, which does not prevent file-writing SQL constructs like INTO OUTFILE or INTO DUMPFILE. An attacker who can influence the input to this tool, for example through prompt injection on a public agent endpoint, may exploit this to write arbitrary files to the database server if the MySQL/MariaDB account has the FILE privilege and the server configuration allows writing to locations such as web-accessible directories. This vulnerability is fixed in version 2.8.12.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to write arbitrary files to the database server, potentially to locations accessible via the web. This could lead to unauthorized file creation, modification, or even remote code execution if malicious files are placed in executable directories. The impact includes loss of data integrity and confidentiality, and it may allow attackers to compromise the server or escalate privileges.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Neuron to version 2.8.12 or later, where the vulnerability is fixed. Additionally, restrict or remove the FILE privilege from MySQL/MariaDB accounts used by the application to prevent arbitrary file writes. Review server configuration to ensure that writing files to web-accessible directories is not permitted.