CVE-2025-58448: rAthena has SQL Injection in PartyBooking component via `WorldName` parameter.
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via WorldName parameter. Commit 0d89ae0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rAthenato a version that resolves this vulnerability.Patch 0d89ae0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58448?
CVE-2025-58448 is classified as a critical vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2025-58448?
To fix CVE-2025-58448, update rAthena to a version that is 0d89ae0 or later.
What software is affected by CVE-2025-58448?
CVE-2025-58448 affects all versions of rAthena prior to commit 0d89ae0.
What type of vulnerability is CVE-2025-58448?
CVE-2025-58448 is a SQL Injection vulnerability found in the PartyBooking component of rAthena.
What is the impact of exploiting CVE-2025-58448?
Exploiting CVE-2025-58448 could allow an attacker to execute arbitrary SQL commands in the database.