Infosphere Information Server EUVD-2025-19079

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) indicates this is a networked, low-complexity attack requiring only low privileges (authenticated user access) with no user interaction needed. The high confidentiality impact (C:H) is the primary concern, enabling data exfiltration. The integrity (I:L) and availability (I:L) impacts are moderate. While no EPSS score or KEV (Known Exploited Vulnerability) status is provided in the submission data, the combination of low attack complexity, authenticated access, and network accessibility makes this a credible real-world threat. Organizations with InfoSphere deployments exposed to untrusted authenticated users or with compromised user credentials face immediate risk. The vulnerability is not zero-day in nature (assigned CVE identifier suggests public disclosure) and likely has proof-of-concept availability in security communities.

An authenticated InfoSphere user (e.g., report developer with normal privileges) crafts a malicious SQL injection payload in a search filter, query parameter, or report builder field. Example: In a table filter field, the attacker enters: ' OR '1'='1' UNION SELECT password FROM admin_users--. The vulnerable application concatenates this into a query without sanitization, allowing the attacker to extract password hashes or sensitive data. No user interaction is required once the payload is submitted. The attacker leverages their existing authenticated session to bypass initial access controls, then exploits the SQL injection to escalate data access beyond their intended role. In a multi-tenant environment, the attacker could extract data from other tenants' schemas.