EUVD-2026-55882
GHSA-wm86-5vhp-x9q6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network-accessible injection requiring only a low-privilege account; DDL impact is structurally significant but vendor-rated Low across all CIA dimensions with no scope change.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to the database structure, resulting in a low impact to the confidentiality, integrity, and availability of the system.
AnalysisAI
SQL DDL injection in SAP Social Intelligence (versions 102-109) allows an authenticated low-privilege network attacker to directly execute Data Definition Language commands against the underlying database. Exploitation can alter or destroy database schema objects - a more structurally damaging capability than typical DML injection - with vendor-rated Low impact across confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated user account in SAP Social Intelligence with at minimum low-privilege access (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.3 Medium rating reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege-required (PR:L) attack with no user interaction and unscoped, uniformly Low impact across all three CIA dimensions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch documented in SAP Security Note 3766473 (https://me.sap.com/notes/3766473), released as part of SAP Security Patch Day (https://url.sap/sapsecuritypatchday). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today