PT-2025-17389 · Web.Py+1 · Web.Py+1

Luaklein · Published 2025-04-15 · Updated 2025-09-03 · CVE-2025-3818

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions webpy web.py version 0.70

Description A critical vulnerability was found in webpy web.py. The function PostgresDB. process insert query of the file web/db.py is affected. The manipulation of the argument seqname leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations As a temporary workaround, consider disabling the PostgresDB. process insert query function until a patch is available. Restrict access to the web/db.py file to minimize the risk of exploitation. Avoid using the seqname argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

BDU:2025-05028

CVE-2025-3818

DLA-4189-1

Affected Products

Debian

Web.Py

References · 22

• 🔥 https://noppgwz8if.feishu.cn/docx/TxjpddUpTokyBwxibSgcTRr7nUf · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-3818 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-3818 · Security Note
• https://bdu.fstec.ru/vul/2025-05028 · Security Note
• https://osv.dev/vulnerability/DLA-4189-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-3818 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3818 · Security Note
• https://ubuntu.com/security/CVE-2025-3818 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-3818 · Vendor Advisory
• https://github.com/webpy/webpy · Note
• https://vuldb.com/?id.305724 · Note
• https://vuldb.com/?submit.555649 · Note
• https://twitter.com/CVEnew/status/1913823708126265429 · Twitter Post
• https://reddit.com/r/debian/comments/1n79g7f/debian_131_and_1212_20250906 · Reddit Post