PT-2025-29510 · Unknown · Metersphere

Liqiang-Fit2Cloud · Published 2025-07-14 · Updated 2025-07-14 · CVE-2025-53639

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MeterSphere versions prior to 3.6.5-lts

Description: MeterSphere, a continuous testing platform, contains a flaw due to improper validation or sanitization of the sortField parameter in specific API endpoints. This allows attackers to inject and execute arbitrary SQL statements through the sorting functionality, potentially leading to modification or deletion of database contents and a full compromise of the application’s database integrity and availability.

Recommendations: Update to version 3.6.5-lts or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-53639

GHSA-VCM3-5W3F-9F45

Affected Products

Metersphere

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53639.json · Exploit
• https://github.com/metersphere/metersphere/security/advisories/GHSA-vcm3-5w3f-9f45 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53639 · Security Note
• https://twitter.com/CVEnew/status/1944860706760741112 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1944900581383954720 · Twitter Post
• https://t.me/cvetracker/27817 · Telegram Post