CVE-2025-57529

YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation. This allows remote unauthenticated attackers to execute arbitrary SQL commands via crafted input to the parameter. Successful exploitation could lead to unauthorized data access

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/songqb-xx/CPAS-bug	Exploit Third Party Advisory
https://github.com/songqb-xx/CVE-2025-57529/blob/main/README.md	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:youdatasum:cpas_audit_management_system:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-03 18:16

Updated : 2026-06-17 09:43

NVD link : CVE-2025-57529

Mitre link : CVE-2025-57529

CVE.ORG link : CVE-2025-57529

JSON object : View

Products Affected

youdatasum

cpas_audit_management_system

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-57529", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57529", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-02-04T15:39:38.416448Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-02-03T18:16:13.403", "references": [{"url": "https://github.com/songqb-xx/CPAS-bug", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/songqb-xx/CVE-2025-57529/blob/main/README.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation. This allows remote unauthenticated attackers to execute arbitrary SQL commands via crafted input to the parameter. Successful exploitation could lead to unauthorized data access"}, {"lang": "es", "value": "YouDataSum CPAS Audit Management System <=v4.9 es vulnerable a inyecci\u00f3n SQL en /cpasList/findArchiveReportByDah debido a una insuficiente validaci\u00f3n de entrada. Esto permite a atacantes remotos no autenticados ejecutar comandos SQL arbitrarios a trav\u00e9s de una entrada manipulada al par\u00e1metro. La explotaci\u00f3n exitosa podr\u00eda conducir a un acceso no autorizado a datos."}], "lastModified": "2026-06-17T09:43:10.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:youdatasum:cpas_audit_management_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9020435D-22BF-453E-89A7-899461020760", "versionEndIncluding": "4.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}