PT-2025-13576 · Epicor · Epicor Hcm

Malik Tawfiq · Published 2025-03-28 · Updated 2025-04-11 · CVE-2025-22953

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Epicor HCM version 2021 1.9

Description A SQL injection issue exists, specifically in the filter parameter of the "JsonFetcher.svc" endpoint. An attacker can exploit this by injecting malicious SQL payloads into the filter parameter, enabling the unauthorized execution of arbitrary SQL commands on the backend database. If certain features, like xp cmdshell, are enabled, this may lead to remote code execution.

Recommendations For Epicor HCM version 2021 1.9, consider disabling the JsonFetcher.svc endpoint or restricting access to the filter parameter until a patch is available. Avoid using the filter parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-22953

Affected Products

Epicor Hcm

References · 10

• 🔥 https://github.com/maliktawfiq/CVE-2025-22953 · Exploit
• https://osv.dev/vulnerability/CVE-2025-22953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22953 · Security Note
• https://tinted-hollyhock-92d.notion.site/EPICOR-HCM-Unauthenticated-Blind-SQL-Injection-CVE-2025-22953-170f1fdee211803988d1c9255a8cb904?pvs=4 · Note
• https://t.me/cvedetector/21486 · Telegram Post
• https://twitter.com/CVEnew/status/1905811730522865828 · Twitter Post
• https://t.me/cvetracker/20227 · Telegram Post
• https://t.me/ckure/15445 · Telegram Post
• https://epiusers.help/t/alert-hcm-security-patch/124777 · Note
• https://t.me/ckured/578 · Telegram Post