EUVD-2025-17539
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer allows Blind SQL Injection. This issue affects MyStyle Custom Product Designer: from n/a through 3.21.1.
AnalysisAI
Blind SQL injection vulnerability in mystyleplatform's MyStyle Custom Product Designer that allows unauthenticated remote attackers to extract sensitive data through time-based or error-based SQL injection techniques. All versions up to and including 3.21.1 are affected. The high CVSS score of 9.3 reflects the critical nature of unauthenticated network-accessible SQL injection with high confidentiality impact, though integrity is not directly compromised and availability impact is limited.
Technical ContextAI
The vulnerability resides in the MyStyle Custom Product Designer application (CWE-89: Improper Neutralization of Special Elements used in an SQL Command), a platform used for customizable product design functionality. The root cause is insufficient input validation/parameterization in SQL query construction, allowing attackers to inject arbitrary SQL commands through user-supplied parameters. This is classified as blind SQL injection rather than error-based, meaning attackers cannot directly observe query results but can infer data through timing differences (response delays) or boolean-based inference. The affected CPE range is mystyleplatform MyStyle Custom Product Designer versions from unspecified baseline through 3.21.1, suggesting the vulnerability has existed across multiple releases without proper sanitization of database queries.
RemediationAI
Patching: Upgrade MyStyle Custom Product Designer to a version newer than 3.21.1 (specific patch version not provided in CVE description; contact mystyleplatform or monitor their security advisories); priority: Immediate Temporary Mitigation: Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns (e.g., UNION, SLEEP, IF/CASE statements) in parameters passed to the Custom Product Designer endpoints; priority: High Temporary Mitigation: Restrict network access to MyStyle Custom Product Designer administrative and design endpoints using IP whitelisting or VPN requirements; priority: High Code-Level Fix: Implement parameterized queries (prepared statements) for all database interactions; use ORM frameworks with built-in SQL injection protections; priority: Critical Monitoring: Enable database query logging and audit logs for suspicious patterns (e.g., UNION-based queries, time delays, error messages leaking schema); priority: Medium
Share
External POC / Exploit Code
Leaving vuln.today