PT-2025-29510 · Unknown · Metersphere

Liqiang-Fit2Cloud · Publicado 2025-07-14 · Atualizado 2025-07-14 · CVE-2025-53639

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MeterSphere versions prior to 3.6.5-lts

Description: MeterSphere, a continuous testing platform, contains a flaw due to improper validation or sanitization of the sortField parameter in specific API endpoints. This allows attackers to inject and execute arbitrary SQL statements through the sorting functionality, potentially leading to modification or deletion of database contents and a full compromise of the application’s database integrity and availability.

Recommendations: Update to version 3.6.5-lts or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-53639

GHSA-VCM3-5W3F-9F45

Produtos afetados

Metersphere

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53639.json · Exploit
• https://github.com/metersphere/metersphere/security/advisories/GHSA-vcm3-5w3f-9f45 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1944860706760741112 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-53639 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1944900581383954720 · Publicação no Twitter
• https://t.me/cvetracker/27817 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-53639 · Nota de Segurança