PT-2025-15292 · Unknown · Xiaozhi-Esp32-Server-Java

Exp3N5Ive · Published 2025-04-07 · Updated 2025-04-07 · CVE-2025-3382

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7

Description A critical issue has been found in the software, affecting the update function of the "/api/user/update" API endpoint. The manipulation of the state argument leads to SQL injection. This issue can be exploited remotely.

Recommendations As a temporary workaround, consider disabling the update function of the "/api/user/update" API endpoint until a fix is available. Restrict access to the "/api/user/update" API endpoint to minimize the risk of exploitation. Avoid using the state argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-3382

Affected Products

Xiaozhi-Esp32-Server-Java

References · 8

• 🔥 https://github.com/exp3n5ive/Vul/blob/main/xiaozhi-sqli/xiaozhi-sqli.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-3382 · Security Note
• https://t.me/cvetracker/21038 · Telegram Post
• https://vuldb.com/?ctiid.303628 · Note
• https://twitter.com/CVEnew/status/1909339496463974403 · Twitter Post
• https://vuldb.com/?id.303628 · Note
• https://vuldb.com/?submit.552387 · Note
• https://t.me/cvedetector/22343 · Telegram Post