CVE-2025-22992
Published: 06 February 2025
Summary
CVE-2025-22992 is a critical-severity SQL Injection (CWE-89) vulnerability in Openenergymonitor Emoncms. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-22992 is a SQL injection vulnerability affecting the Emoncms project in versions greater than or equal to 11.6.9. The issue resides in the /feed/insert.json endpoint, where improper handling of user-supplied input in the data query parameter enables attackers to execute arbitrary SQL commands under specific conditions. This flaw is classified under CWE-89 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation.
The vulnerability can be exploited by unauthenticated remote attackers with network access, requiring low complexity and no user interaction. Successful exploitation allows execution of arbitrary SQL commands, potentially granting high levels of confidentiality, integrity, and availability impacts, such as data exfiltration, modification, or denial of service on the underlying database.
Mitigation details and further information are available in the referenced advisory at https://github.com/emoncms/emoncms/issues/1916.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3065
Vulnerability details
A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project >= 11.6.9. The vulnerability is caused by improper handling of user-supplied input in the data query parameter, allowing attackers to execute arbitrary SQL commands under specific conditions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public /feed/insert.json web endpoint enables remote unauthenticated exploitation of the public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the SQL injection vulnerability by enforcing validation of user-supplied input in the data query parameter to prevent arbitrary SQL command execution.
Enables timely patching and remediation of the specific flaw in the /feed/insert.json endpoint as detailed in the advisory.
Boundary protection at web application interfaces can deploy web application firewalls to detect and block SQL injection attempts on the unauthenticated endpoint.