TDuckCloud tduck-platform CVE-2025-7888

Exploitation requires valid authentication credentials to access the tduck-platform application (PR:L per CVSS vector). The formKey parameter must be passed to the UserFormDataMapper function through a form-related API endpoint or interface. No special configuration or non-default settings appear to be required beyond standard installation. The attack is initiated remotely over the network (AV:N), and there is no requirement for user interaction (UI:N). The limiting factor for exploitation scope is the authenticated requirement and limited database permissions typically granted to application service accounts.

Despite the critical classification in the description, the actual risk profile is significantly lower than suggested by that label. The CVSS v4.0 score of 2.1 reflects the genuine threat level: exploitation requires prior authentication (PR:L), network vector is standard (AV:N/AC:L), and impact is limited to low confidentiality and integrity (VC:L/VI:L/VA:L) with no scope elevation. The EPSS score of 0.07% (21st percentile) indicates minimal real-world exploitation probability relative to other vulnerabilities, suggesting this is a lower-priority issue despite public POC availability. The presence of publicly available exploit code (marked E:P) combined with vendor non-response creates some urgency for patching, but the authentication requirement and limited impact mean this does not warrant emergency response procedures. Defenders should prioritize this lower than high-CVSS network-unauthenticated vulnerabilities, though patching remains necessary given public exploit availability.

An authenticated user of TDuckCloud tduck-platform crafts a malicious formKey parameter containing SQL injection payload (e.g., formKey=' OR '1'='1) and submits it through a form creation or data mapping endpoint. The UserFormDataMapper processes this unsanitized input and incorporates it directly into a SQL query, allowing the attacker to extract sensitive data from the database or modify database records depending on database permissions.