EUVD-2025-209547
GHSA-3792-hr7r-4rr7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable app requiring a valid low-privilege account (PR:L) for straightforward SQL injection yielding full database read/write/availability impact, hence C/I/A all High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A SQL injection vulnerability exists in Genesys Latitude v25.1.0.420 that allows an authenticated attacker to execute arbitrary SQL queries against the backend database. The vulnerability is caused by unsanitized user-supplied input being concatenated directly into SQL statements.
AnalysisAI
SQL injection in Genesys Latitude v25.1.0.420 allows an authenticated attacker to run arbitrary SQL queries against the backend database, enabling full read/write access to stored data. The flaw stems from user-supplied input being concatenated directly into SQL statements (CWE-89). Publicly available exploit code exists per the referenced okunsec research, but the EPSS score is negligible (0.01%, 2nd percentile) and it is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Technical ContextAI
Genesys Latitude is a collections and receivables-management platform used in the debt-recovery industry, backed by a relational (typically SQL Server) database. The vulnerability is a classic CWE-89 SQL Injection: the application builds SQL statements via string concatenation of untrusted user input instead of using parameterized queries or prepared statements, so attacker-controlled characters break out of the intended data context and alter query logic. The CPE data provided is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not enumerate a canonical vendor/product string, so exact-match automated detection cannot rely on NVD CPE here; identification rests on the vendor and version named in the description (v25.1.0.420).
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so a specific upgrade target cannot be cited; monitor http://genesys.com and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-70420) for an official advisory and apply the vendor fix as soon as it is published. In the interim, because exploitation requires an authenticated account, tighten access controls: restrict Latitude application accounts to trusted personnel and enforce least-privilege on the underlying database service account (deny it schema/DDL and cross-database rights) to limit blast radius of any injected query. Place a WAF or database-activity-monitoring layer in front of the affected input parameters to detect and block SQL metacharacters, and remove any unnecessary network exposure of the application so it is reachable only from internal or VPN-gated segments - noting that WAF signatures can be bypassed and that restricting access may disrupt remote collectors, so treat these as stopgaps until a patch exists. Consult the okunsec write-up (https://okunsec.com/research/cve-2025-70420) and VulDB entry (https://vuldb.com/vuln/358749) for affected-parameter specifics to target mitigations.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today