CVE-2025-0558
Published: 18 January 2025
Summary
CVE-2025-0558 is a medium-severity Injection (CWE-74) vulnerability in Tduckcloud Tduck-Platform. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by requiring validation of untrusted inputs like the 'color' argument in QueryProThemeRequest before processing.
SI-2 ensures timely remediation of the specific SQL injection flaw in tduck-platform up to 4.0 through patching or equivalent mitigations.
SI-4 supports detection of SQL injection exploitation by monitoring for anomalous database queries involving the 'color' parameter.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web parameter of cloud form platform enables exploitation of public-facing application (T1190), abuse of server software component (T1505 as cited in advisory), and collection from databases (T1213.006).
NVD Description
A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulnerability affects the function QueryProThemeRequest of the file src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java. The manipulation of the argument color leads to sql injection. The attack can be initiated remotely. The…
more
exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-0558 is a SQL injection vulnerability classified as critical in TDuckCloud tduck-platform versions up to 4.0. The issue resides in the QueryProThemeRequest function within the file src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java, where manipulation of the 'color' argument enables SQL injection. It is associated with CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection), carrying a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability was published on 2025-01-18.
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring no user interaction and low complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability through SQL injection, potentially enabling unauthorized data access, modification, or denial of service on the affected platform.
Advisories from VulDB and a related GitHub repository indicate that an exploit has been publicly disclosed and may be actively used. The vendor was contacted early regarding the issue but has not responded or provided any patches or mitigations as of the latest information. Security practitioners should isolate affected instances, monitor for anomalous queries involving the 'color' parameter, and consider input validation or upgrades if available.
Details
- CWE(s)