CVE-2025-9953
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-9953 is a critical-severity Authorization Bypass Through User-Controlled SQL Primary Key (CWE-566) vulnerability in Gov (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-9953 is an authorization bypass vulnerability stemming from a user-controlled SQL primary key, enabling SQL injection in Databank Accreditation Software developed by DATABASE Software Training Consulting Ltd. The flaw affects all versions of the software up to and including 19022026. Assigned CWE-566, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.
Remote attackers require no authentication or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows arbitrary SQL injection, bypassing authorization controls to achieve high-impact confidentiality, integrity, and availability violations, such as unauthorized data access, modification, or deletion within the affected database.
The sole referenced advisory from the Turkish National Cyber Incident Response Center (USOM) at https://www.usom.gov.tr/bildirim/tr-26-0078 details the vulnerability. The vendor was notified early but provided no response, and no patches or mitigations are available from the vendor as of the CVE publication on 2026-02-19.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207685
Vulnerability Data
Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection. This issue affects Databank Accreditation Software: before 2026/04.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires enforcement of authorizations on every access request, which directly stops a caller from reaching unauthorized rows via a supplied primary key.
AC-24 mandates that access-control decisions be applied to each request, preventing blind trust of a user-supplied primary key.
Least privilege reduces the set of records an account can touch, limiting blast radius even if the key check is missing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing policy-based authorization and least privilege directly prevents actor-controlled primary-key access to unauthorized records.
Secure SDLC practices include input validation, parameterized queries, and authorization checks that eliminate this class of SQL primary-key bypass.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect missing authorization checks and unsafe SQL construction before release.
Enforcing information-access restrictions prevents direct use of user-supplied primary keys to bypass authorization checks.
Access-control policy sets the governance expectation that all data access must be authorized, indirectly supporting prevention of CWE-566.
Defining application security requirements includes mandatory server-side authorization and parameterized queries that block this weakness.
Secure architecture principles require least-privilege data access and input validation, directly mitigating the described authorization bypass.
Secure-coding standards mandate parameterized queries and server-side authorization, eliminating the root cause of CWE-566.