PT-2025-37025 · Unknown+1 · Shibboleth Service Provider+2

Florian Stuhlmann · Published 2025-09-07 · Updated 2025-11-07 · CVE-2025-9943

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Shibboleth Service Provider versions through 3.5.0

Description: An SQL injection vulnerability exists in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage. An unauthenticated attacker can exploit this issue via blind SQL injection, potentially extracting arbitrary data from the database if the database connection uses the ODBC plugin. The vulnerability stems from inadequate escaping of single quotes within the SQLString class (file odbc-store.cpp, lines 253-271).

Recommendations: For versions through 3.5.0, ensure proper escaping of single quotes in the SQLString class within the odbc-store.cpp file. As a temporary workaround, consider disabling the replay cache feature or switching to a different storage mechanism that is not susceptible to SQL injection attacks.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-9943

DLA-4300-1

DSA-5994-1

OPENSUSE-SU-2025:15714-1

Affected Products

Debian

Odbc Plugin

Shibboleth Service Provider

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2025-9943 · Security Note
• https://shibboleth.net/community/advisories/secadv_20250903.txt · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4300-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-9943 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-9943 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5994-1 · Vendor Advisory
• https://shibboleth.net/downloads/service-provider/3.5.1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-9943 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-9943 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15714-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-9943 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9943 · Vendor Advisory
• https://twitter.com/CVEnew/status/1965691846807769414 · Twitter Post
• https://lists.debian.org/debian-lts-announce/2025/09/msg00015.html · Note
• https://twitter.com/offseq/status/1965686854499307835 · Twitter Post