CVE-2025-9943
Published: 10 September 2025
Summary
CVE-2025-9943 is a critical-severity SQL Injection (CWE-89) vulnerability in Shibboleth Service Provider (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-9943 is an SQL injection vulnerability in the Shibboleth Service Provider (SP) through version 3.5.0. The issue occurs in the "ID" attribute of the SAML response when the replay cache is configured to use an SQL database as the storage service via the ODBC plugin. It stems from insufficient escaping of single quotes in the SQLString class (odbc-store.cpp, lines 253-271), enabling blind SQL injection that allows extraction of arbitrary data from the database. The vulnerability is rated with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is associated with CWE-89.
An unauthenticated attacker with network access can exploit this vulnerability by sending a specially crafted SAML response. The low attack complexity and lack of prerequisites enable remote exploitation without user interaction, resulting in high confidentiality and integrity impacts through data exfiltration or manipulation within the targeted database.
Shibboleth has released version 3.5.1 to address the issue, as noted in their security advisory (secadv_20250903.txt) and download page. Additional guidance appears in advisories from SEC Consult, Full Disclosure mailing list, and Debian LTS, recommending immediate upgrades for affected deployments using the ODBC storage plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-27518
Vulnerability details
An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit…
more
this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271). This issue affects Shibboleth Service Provider through 3.5.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in publicly exposed Shibboleth SP (SAML) replay cache directly enables remote unauthenticated exploitation of a public-facing application for database data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the SAML ID attribute input to prevent blind SQL injection from unescaped single quotes in the ODBC SQL storage.
Mandates timely patching to Shibboleth 3.5.1, which remediates the SQL injection flaw in the replay cache's ODBC plugin.
Provides vulnerability scanning to identify the SQL injection vulnerability in Shibboleth SP configurations using ODBC SQL storage.