PT-2025-45570 · Unknown · Aapanel Baota

Blackspdier + 1 · Published 2025-11-08 · Updated 2025-12-02 · CVE-2025-12914

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.1.1

Description A SQL injection issue exists in aaPanel BaoTa. The issue is located in the Backend component, specifically within the /database?action=GetDatabaseAccess endpoint. Manipulation of the Name parameter can lead to SQL injection. The exploit has been publicly disclosed. The vendor was notified but did not respond.

Recommendations Update aaPanel BaoTa to version 11.1.1 or later.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-12914

Affected Products

Aapanel Baota

References · 11

• 🔥 https://github.com/coolcj-stack/BaoTa-Panel-Backstage-SQL-injection-vulnerability/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12914 · Security Note
• https://twitter.com/CVEnew/status/1987273077433176534 · Twitter Post
• https://t.me/cveNotify/144501 · Telegram Post
• https://t.me/CVEtracker/36869 · Telegram Post
• https://vuldb.com/?id.331632 · Note
• https://vuldb.com/?ctiid.331632 · Note
• https://twitter.com/VulmonFeeds/status/1987287030993223734 · Twitter Post
• https://docs.bt.cn/notices/CVE-2025-12914 · Note
• https://t.me/cveNotify/142216 · Telegram Post
• https://vuldb.com/?submit.678237 · Note