CVE-2025-71458— FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo

Quick assessment

Affected

cern-fts fts-monitoring

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FTS3 Web Monitoring（fts-monitoring）3.12.0 至 3.13.2 版本以及 3.14.0 版本中，由函数处理的端点存在一个无需认证的 SQL 注入漏洞。远程攻击者可通过和查询参数注入 SQL 语句，执行盲注攻击，从而读取已存储的云存储凭证和令牌提供者客户端密钥（client secrets）。

CVSS 7.5 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1040 · Network Sniffing T1059.006 · Python T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo

Source: CVE Program / CVE List V5

Vulnerability Description

FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
cern-fts	fts-monitoring	3.12.0 ~ 3.13.3	-

II. Public POCs for CVE-2025-71458

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-71458

请登录查看更多情报信息。

Other References for CVE-2025-71458 (8)

https://github.com/cern-fts/fts-monitoring product
https://github.com/cern-fts/fts-monitoring/commit/e993c27d60a150c67cc2b415ddb272b5d3f05596 patch
https://github.com/cern-fts/fts-monitoring/commit/96241f6e9911195aae8e9e07bce511da4e81fc08 patch
https://advisories.egi.eu/Advisory-EGI-SVG-2025-09 third-party-advisory
https://github.com/cern-fts/fts-monitoring/blob/v3.14.0/src/apps/ftsmon/views/linkinfo.py#L27-L60 technical-description
https://github.com/cern-fts/fts-monitoring/releases/tag/v3.13.3 release-notes
https://github.com/cern-fts/fts-monitoring/releases/tag/v3.14.1 release-notes
https://www.vulncheck.com/advisories/fts3-web-monitoring-3.12.0-through-3.13.2-and-3.14.0-sql-injection-via-linkinfo third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2025-71458

IV. Related Vulnerabilities

Same weakness: CWE-89