SQLi in ScienceLogic# CVE-2025-58780
# Vulnerability Disclosure: SQL Injection in ScienceLogic
## Overview
This document outlines a responsibly disclosed SQL injection vulnerability found in ScienceLogic's web platform. The vulnerability has been reported to the project maintainers in accordance with responsible disclosure practices to ensure timely mitigation and protection of users.
## Vulnerability Details
- **Type**: SQL Injection
- **Component**: index.em7 file in ScienceLogic web platform
- **CVE ID**: CVE-2025-58780
- **Discovered By**:Gareth Catterall
- **Discovery Date**: 2023
- **Reported Date**: 2023
- **Vendor**: ScienceLogic
- **Impact**: High
### Description
An SQL injection vulnerability was identified in ScienceLogic's web platform, specifically in the index.em7 file. A parameter passed as part of a request can be supplied with SQL statements, allowing an attacker to manipulate the database request and potentially gain unauthorized access to sensitive data or control over the database.
### Affected Versions
- **Affected Product Code Base**: ScienceLogic - All versions prior to 12.1.1
- **Unaffected Versions**: ScienceLogic v12.1.1 and later (fixed in this version)
### Proof of Concept
- disclosed to vendor
## Mitigation
- **Users**: Upgrade to ScienceLogic version 12.1.1 or later to mitigate the vulnerability.
- **Maintainers**: The issue has been fixed by ScienceLogic in version 12.1.1.
## Responsible Disclosure Policy
This vulnerability was disclosed following responsible disclosure principles:
- Reported privately to ScienceLogic maintainers.
- Allowed reasonable time for a patch to be developed and deployed.
- Avoided sharing exploit details publicly until a patch was available.
## Acknowledgments
Thanks to ScienceLogic for their cooperation in addressing this vulnerability promptly.
- https://docs.sciencelogic.com/release_notes_html/Content/12-1-1/12-1-1_release_notes.htm#New_Features_in_12-1-1
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view