EUVD-2025-19079CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Lifecycle Timeline
3DescriptionNVD
IBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
AnalysisAI
CVE-2025-0966 is a SQL injection vulnerability in IBM InfoSphere Information Server 11.7 that allows authenticated remote attackers to execute arbitrary SQL commands against the backend database. An attacker with valid credentials can view, add, modify, or delete sensitive information without administrative privileges. The vulnerability carries a CVSS score of 7.6 (High) and requires low attack complexity, making it a significant risk for organizations using affected versions.
Technical ContextAI
This vulnerability stems from CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection flaw where user-controlled input is concatenated into SQL queries without proper parameterization or input validation. IBM InfoSphere Information Server 11.7 fails to sanitize crafted SQL statements before passing them to the backend database engine. The affected component likely resides in the application's data query interface, request handler, or reporting module that constructs dynamic SQL queries. Without prepared statements or parameterized queries, attackers can manipulate query logic by injecting SQL metacharacters and commands.
RemediationAI
Immediate actions: (1) Apply IBM security patches for InfoSphere Information Server 11.7 when released—check IBM Security Advisories (https://www.ibm.com/support/pages/security-bulletins) for the specific fix version; (2) If patches are unavailable, restrict network access to InfoSphere services using firewall rules, limiting connections to trusted IP ranges; (3) Implement strict input validation and output encoding at the application layer; (4) Migrate to patched versions (likely 11.7.1+ or newer stable release); (5) Apply principle of least privilege to database service accounts used by InfoSphere; (6) Monitor database query logs for suspicious SQL patterns (e.g., UNION, stacked queries, comments). Long-term: upgrade to current InfoSphere versions with security hardening.
More from same product – last 7 days
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.1 lets unauthenticated network attackers run arbitr
Remote code execution and authentication bypass are possible in IBM Aspera High-Speed Transfer Server and High-Speed Tra
Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 throu
Hard-coded credentials in IBM Controller (versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2) give attackers a static, embedded
Arbitrary code execution in IBM Aspera High-Speed Transfer Server and Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1)
Share
External POC / Exploit Code
Leaving vuln.today