EUVD-2025-208720Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates moderate real-world risk with several mitigating factors. The local attack vector (AV:L) significantly reduces exploitability in most environments, as the attacker must already be on the system or authenticated to the application. The high attack complexity (AC:H) further restricts the attack surface, suggesting specific conditions must be met or exploitation is difficult to execute reliably. Low privilege requirements (PR:L) mean an attacker with a basic user account can attempt the exploit, which increases concern for multi-tenant deployments. The limited scope impact (S:U) and single-category damage (C:L/I:L/A:L across confidentiality, integrity, and availability) suggest the vulnerability grants access to only a subset of data or functions rather than complete system compromise. Without confirmed KEV listing, active exploitation reports, or published POC evidence, this appears to be a real but lower-priority vulnerability suitable for standard patching cycles rather than emergency response. The vulnerability is primarily a concern for organizations with elevated insider threat risk or those where local users have broad application access. |
| Exploit ScenarioDerived | An authenticated user with basic privileges in HCL AION gains access to an offering configuration interface that accepts SQL-like parameters without proper validation. By crafting malicious input in configuration fields, the user injects additional SQL commands that execute with the application's database credentials, allowing them to query sensitive data beyond their authorization level or modify database records. Alternatively, a local attacker with shell access to the AION server could interact directly with configuration files or API endpoints that construct SQL queries, achieving similar results. The high attack complexity suggests the attacker must have detailed knowledge of the specific offering configuration format and database schema, or must conduct reconnaissance to identify exploitable parameters. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
HCL AION contains a SQL injection or improper query validation vulnerability that allows authenticated local users with low privileges to execute potentially harmful SQL queries against the database. The vulnerability affects certain offering configurations and could lead to limited information disclosure, data modification, or denial of service under specific conditions. With a CVSS score of 4.5 and local attack vector requirement, this represents a moderate-risk vulnerability primarily exploitable by insider threats or compromised local accounts.
RemediationAI
Organizations using HCL AION should immediately check the HCL PSIRT advisories and security updates for patch availability targeting this vulnerability and apply updates to affected systems. Until patches are available, implement compensating controls including: enforcing least-privilege database account credentials for AION application processes (use read-only or restricted stored procedures), restricting access to AION offering configuration modules to only required administrative users, implementing database-level query logging and monitoring to detect anomalous SQL execution patterns, and disabling or restricting features that permit user-supplied query parameters if not essential to operations. Network segmentation to limit local system access and multi-factor authentication for administrative accounts can reduce the likelihood of credential compromise that would enable exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper input validation or insufficient access control restrictions on SQL query execution within HCL AION's database interaction layer. This likely represents a CWE-89 (SQL Injection) or CWE-863 (Incorrect Authorization) class flaw where user-supplied input is insufficiently sanitized before being incorporated into SQL queries, or where authorization checks fail to prevent unprivileged users from executing queries beyond their intended scope. The issue is specific to HCL AION's offering configuration modules, suggesting the vulnerability may exist in configuration parsers or query builders that handle user-provided parameters without adequate parameterized query usage or stored procedure enforcement. The local attack vector (AV:L) indicates the attacker must have some form of system access, whether through a compromised account, shell access, or application-level authenticated session.
Know when Hcl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or restrictions on query execution could expose the system to unintended database interactions or limited information exposure under specific conditions.
Executive ViewAI
Organizations using HCL AION should be aware of moderate risk from CVE-2025-52637, a SQL injection vulnerability rated CVSS 4.5. Exploitation could allow attackers to execute code or inject malicious input. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in HCL AION Image Integrity Issues
View all 2Information disclosure in HCL Unica Centralized Offer Management allows unauthenticated remote attackers to obtain sensi
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the
HCL DFXAnalytics 3.1 and earlier ship with outdated third-party libraries or sub-components that carry publicly known vu
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
HCL DFXAnalytics 3.1 and earlier transmit sensitive data across the network without transport encryption, allowing anyon
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) ser
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative scr
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
GitHub PoC
Exploit-DB