CVE-2025-52085: SQL Injection
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner and version, current database user and schema, the current DBMS user privileges, and arbitrary data from any table.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated to the Yoosee application. No user interaction is required, and the vulnerable backend API endpoint is reachable over the network.
What could an attacker obtain through successful exploitation?
An attacker can run arbitrary SQL queries and extract sensitive database information. This includes the database banner and version, current database user and schema, DBMS privileges, and arbitrary data from any table.
Which version is identified as affected?
The reported affected version is Yoosee application 6.32.4.