CVE-2025-55703

An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays without proper input validation. This can allow attackers to manipulate SQL queries. This has been addressed in Power IQ version 9.2.1, where the API call code was updated to ensure safe handling of input values.

CVSS v3 2.5 LOW

2.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://pastebin.com/C6hVPpF4	Third Party Advisory
https://www.sunbirddcim.com/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:sunbirddcim:power_iq:9.2.0:*:*:*:*:*:*:*

History

14 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección SQL basada en errores existe en la API de Sunbird Power IQ 9.2.0. La vulnerabilidad se debe a un endpoint de API obsoleto que aplicaba arrays sin la validación de entrada adecuada. Esto puede permitir a los atacantes manipular consultas SQL. Esto se ha abordado en Power IQ versión 9.2.1, donde el código de llamada a la API fue actualizado para asegurar el manejo seguro de los valores de entrada.

Information

Published : 2025-12-15 20:15

Updated : 2026-10-14 16:10

NVD link : CVE-2025-55703

Mitre link : CVE-2025-55703

CVE.ORG link : CVE-2025-55703

JSON object : View

Products Affected

sunbirddcim

power_iq

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-55703", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55703", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T20:06:53.301116Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-15T20:15:51.607", "references": [{"url": "https://pastebin.com/C6hVPpF4", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.sunbirddcim.com/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays without proper input validation. This can allow attackers to manipulate SQL queries. This has been addressed in Power IQ version 9.2.1, where the API call code was updated to ensure safe handling of input values."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL basada en errores existe en la API de Sunbird Power IQ 9.2.0. La vulnerabilidad se debe a un endpoint de API obsoleto que aplicaba arrays sin la validaci\u00f3n de entrada adecuada. Esto puede permitir a los atacantes manipular consultas SQL. Esto se ha abordado en Power IQ versi\u00f3n 9.2.1, donde el c\u00f3digo de llamada a la API fue actualizado para asegurar el manejo seguro de los valores de entrada."}], "lastModified": "2026-10-14T16:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sunbirddcim:power_iq:9.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA55692C-4E93-4DEE-9BA5-D643A10CD0F8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}