CVE-2025-50979
Published: 27 August 2025
Summary
CVE-2025-50979 is a high-severity SQL Injection (CWE-89) vulnerability in Nodebb Nodebb. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-50979 is a SQL injection vulnerability in NodeBB version 4.3.0, specifically affecting the search-categories API endpoint at /api/v3/search/categories. The search query parameter is not properly sanitized, permitting unauthenticated remote attackers to inject boolean-based blind and PostgreSQL error-based payloads. This flaw, published on 2025-08-27, is categorized under CWE-89 and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required. Exploitation enables high confidentiality impact, such as extracting sensitive data from the underlying PostgreSQL database through blind SQL injection techniques, alongside low impacts to integrity and availability.
A proof-of-concept demonstrating the vulnerability is available at https://github.com/4rdr/proofs/blob/main/info/NodeBB-v4.3.0.-SQL-Injection-via-search-parameter.md, which security practitioners should review for additional technical details on exploitation and potential mitigations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25915
Vulnerability details
NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-based payloads.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing NodeBB API endpoint enables exploitation of public-facing application (T1190) and facilitates collection from databases (T1213.006) using blind boolean-based and error-based payloads.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates validation and sanitization of the unsanitized search query parameter in the /api/v3/search/categories endpoint to block SQL injection payloads.
Requires identification, reporting, and correction of the specific SQL injection flaw in NodeBB v4.3.0 to eliminate the vulnerability.
Ensures error handling suppresses PostgreSQL database error messages, mitigating error-based SQL injection exploitation while blind payloads remain possible.