Skip to main content

Sap Basis CVE-2025-0063

HIGH
SQL Injection (CWE-89)
2025-01-14 cna@sap.com
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:03 vuln.today
Patch released
Mar 28, 2026 - 18:03 nvd
Patch available
CVE Published
Jan 14, 2025 - 01:15 nvd
HIGH 8.8

DescriptionCVE.org

SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.

AnalysisAI

SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability. Affected products include: Sap Sap Basis.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

CVE-2024-34687 CRITICAL
9.0 May 14

SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting

CVE-2016-4551 HIGH
7.5 Oct 05

The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to s

CVE-2026-0484 MEDIUM
6.5 Feb 10

Sap Basis versions up to 700 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).

CVE-2025-42956 MEDIUM
6.1 Jul 08

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link wh

CVE-2025-23193 MEDIUM
5.3 Feb 11

SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respon

CVE-2024-37180 MEDIUM
5.3 Jul 09

Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote

CVE-2026-24312 MEDIUM
5.2 Feb 10

SAP Business Workflow contains an authorization bypass that allows authenticated administrators to escalate privileges b

CVE-2024-34689 MEDIUM
5.0 Jul 09

WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the

CVE-2024-39599 MEDIUM
4.7 Jul 09

Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can by

CVE-2025-42986 MEDIUM
4.3 Jul 08

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privi

CVE-2025-42918 MEDIUM
4.3 Sep 09

SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauth

CVE-2025-42911 MEDIUM
5.0 Sep 09

SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could

Share

CVE-2025-0063 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy