CVE-2025-22964
Published: 15 January 2025
Summary
CVE-2025-22964 is a high-severity SQL Injection (CWE-89) vulnerability in Ddsn Cm3 Acora Content Management System. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an unauthenticated time-based blind SQL injection vulnerability in the handling of the "table" parameter. The flaw stems from insufficient input sanitization and validation, allowing direct incorporation of user-supplied values into database queries without escaping or parameterization, and is tracked as CWE-89 with a CVSS 3.1 score of 8.1.
An attacker with network access can supply crafted input to the affected parameter and execute arbitrary SQL queries against the backend database. Successful exploitation grants the ability to access, manipulate, or extract sensitive data without authentication, resulting in impacts to confidentiality and integrity.
The single public reference is a GitHub repository containing disclosure details; no vendor advisory or patch information is provided in the available sources. The associated EPSS score has remained flat at 0.1626 with no observed rise after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3058
Vulnerability details
DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly incorporating user-supplied input…
more
into database queries without proper escaping or validation. Exploiting this issue enables unauthorized access, manipulation of data, or exposure of sensitive information, posing significant risks to the integrity and confidentiality of the application.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated time-based blind SQL injection vulnerability in a public-facing CMS enables exploitation of public-facing applications (T1190) and facilitates unauthorized data collection from databases (T1213.006) through malicious SQL queries, allowing exposure and manipulation of sensitive information.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of user-supplied inputs like the 'table' parameter before database query incorporation.
Mitigates the vulnerability by identifying, reporting, and correcting the specific input sanitization flaw in the cm3 Acora CMS application.
Enforces restrictions on information inputs such as the 'table' parameter to block malicious SQL injection payloads through whitelisting or format enforcement.