CVE-2025-52694

CRITICALNuclei

Execution of arbitrary SQL commands

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-52694 has a selected CVSS score of 10.0 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators of affected product versions are advised to update to the latest versions immediately.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 12, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

IoTSuite and IoT Edge Products

Browse Advantech / IoTSuite and IoT Edge Products

Default status: unknown

CVE ListSaaSComposer prior to version V3.4.15affected
IoTSuite Growth Linux docker prior to version V2.0.2affected
IoTSuite Starter Linux docker prior to version V2.0.2affected
IoT Edge Linux docker prior to version V2.0.2affected
IoT Edge Windows prior to version V2.0.2affected
WebAccess/SCADA prior to version V9.2.2affected
WebAccess SaaS-Composer prior to version 3.4.15.1affected
ECOWatch SaaS-Composer prior to version 3.4.15affected

Proofs of concept

1

Repository PoCs

GitHubWinz18/CVE-2025-52694-POCRepository PoCby Winz183Exploit3 files

8.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script that sends a crafted HTTP request with a SQL injection payload to a target server and measures the response time to confirm vulnerability. It also includes a Nuclei template for automated scanning. The Python script is classified as an exploit because it actively exercises the vulnerability by injecting a pg_sleep command and interpreting the resulting time delay.

Backdoor review

No backdoor observed in reviewed code

The repository contains a PoC for CVE-2025-52694, a SQL injection vulnerability. The Python script and Nuclei template perform only the described time-based SQL injection test against a user-supplied target. No backdoor, deceptive payload, or concealed operator-directed harm is present in the reviewed text.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPythonYAML
Target softwareAdvantech WISE-IoTSuite/SaaS Composer
Attack typesSQL InjectionTime-based Blind
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively sends a malicious payload (pg_sleep) to the target and uses the resulting time delay to confirm successful SQL injection, which constitutes exploitation rather than mere detection.

cve-2025-52694-poc.py:41-42cve-2025-52694-poc.py:64cve-2025-52694-poc.py:75-80

Requirements

  • Target URL of a vulnerable Advantech instancecve-2025-52694-poc.py:91
  • Valid organization ID (org_id) for the target instancecve-2025-52694-poc.py:92

Observed behavior

  • Constructs a URL with a SQL injection payload in the filename path parametercve-2025-52694-poc.py:41-42
  • Sends an HTTP GET request to the crafted URLcve-2025-52694-poc.py:64
  • Measures the response time and reports the target as vulnerable if the delay exceeds 10 secondscve-2025-52694-poc.py:72-80
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
Payload withheldThe Python PoC constructs and sends this HTTP request to the user-supplied target to test for SQL injection via time delay.cve-2025-52694-poc.py:42cve-2025-52694-poc.py:64
Network Request
Payload withheldThe Nuclei template defines this request to test for the same SQL injection vulnerability across multiple org_id values.cve-2025-52694.yaml:28
Review boundaries

What the analysis did not establish

  • The evidence does not include execution output or confirmation that the code was run against a live target.
  • The Nuclei template is a scanner, but the primary artifact is the Python exploit script.
  • Only the three text files (README.md, cve-2025-52694-poc.py, cve-2025-52694.yaml) were reviewed; no binary or non-text files were present in the evidence.
  • The review does not assess whether the PoC correctly exploits the vulnerability or is safe to run against authorized targets.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryCRITICALAdvantech WISE-IoTSuite/SaaS - SQL InjectionCVSS 10

Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the `filename` parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code (such as the use of `pg_sleep` for time delays) to verify the vulnerability, and may gain further impact such as Remote Code Execution (RCE) depending on the privileges granted to the database user.

Impact

Successful exploitation could allow an attacker to dump the database, modify data, or execute remote commands on the underlying server.

Remediation

Apply the latest security patches provided by Advantech or sanitize the `filename` input parameter to prevent SQL injection.

WeaknessesCWE-89
AuthorsLoi Nguyen Thang
Template tagscvecve2025sqliadvantechiotsaas-composervuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Shodan: title:"SaaS Composer"
FOFA: title="SaaS Composer"
https://www.cve.org/CVERecord?id=CVE-2025-52694 https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001 https://github.com/Winz18/CVE-2025-52694-POC https://nvd.nist.gov/vuln/detail/CVE-2025-52694

Source: ProjectDiscovery

References

3