Description
Progress Chef Automate 是一款用于自动化基础设施和应用程序管理的工具。该漏洞存在于 /api/v0/compliance/profiles/search 接口中，攻击者可以通过构造恶意的 SQL 查询注入数据，绕过身份验证并获取敏感信息，可能导致数据泄露和系统完整性破坏。
Progress Chef Automate /api/v0/compliance/profiles/search SQL 注入漏洞（CVE-2025-8868）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-8868
https://docs.chef.io/release_notes_automate/#4.13.295
https://zeropath.com/blog/cve-2025-8868-chef-automate-sql-injection-summary
https://xbow.com/blog/cooking-an-sql-injection-vulnerability-in-chef-automate
https://access.redhat.com/security/cve/cve-2025-8868
https://www.tenable.com/cve/CVE-2025-8868
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8868.yaml
https://s4e.io/tools/chef-automate-sql-injection-cve-2025-8868
https://community.progress.com/s/article/Security-Fixes-for-Chef-Products---Immediate-Action-Required
https://attackerkb.com/topics/sDS0AP02EX/cve-2025-8868