CVE-2025-5329
Published: 04 February 2026
Summary
CVE-2025-5329 is a critical-severity SQL Injection (CWE-89) vulnerability in Gov (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2025-5329 is an SQL Injection vulnerability (CWE-89) stemming from improper neutralization of special elements used in an SQL command. It affects Martcode Software Inc.'s Delta Course Automation software across all versions through 04022026. The issue was publicly disclosed on 2026-02-04 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.
Remote attackers require no authentication, privileges, or user interaction to exploit this vulnerability over the network with low attack complexity. Successful exploitation enables arbitrary SQL command injection, granting high-impact access to confidentiality, integrity, and availability of the affected system, such as data exfiltration, modification, or disruption.
A related advisory is published at https://www.usom.gov.tr/bildirim/tr-26-0018. The vendor was contacted early about the disclosure but provided no response, and no patches or official mitigations have been issued.
The lack of vendor engagement leaves affected deployments without remediation guidance, increasing exposure risk until organizations implement compensating controls like input validation or network segmentation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206820
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software Inc. Delta Course Automation allows SQL Injection. This issue affects Delta Course Automation: through 04022026. NOTE: The vendor was contacted early about this disclosure…
more
but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a publicly accessible application directly enables remote unauthenticated exploitation matching T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the Delta Course Automation application, blocking the unsanitized SQL elements that enable CVE-2025-5329.
Boundary-protection mechanisms such as WAF rules or network filtering can inspect and drop the malicious SQL payloads before they reach the vulnerable application endpoints.
Continuous monitoring of application traffic and database queries can identify anomalous SQL syntax or error patterns indicative of attempted injection against Delta Course Automation.