CVE-2025-50341 in Axelor
Summary
by MITRE • 08/05/2025
A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter. An attacker can manipulate the SQL query logic and determine true/false conditions, potentially leading to data exposure or further exploitation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2025
The vulnerability identified as CVE-2025-50341 represents a critical Boolean-based SQL injection flaw within Axelor version 5.2.4, specifically affecting the _domain parameter handling mechanism. This vulnerability resides in the application's database interaction layer where user-supplied input is improperly sanitized before being incorporated into SQL query constructs. The flaw allows malicious actors to manipulate the logical flow of database queries through strategic input manipulation, enabling them to infer information about the underlying database structure and content through conditional responses.
The technical exploitation of this vulnerability occurs when the _domain parameter receives unvalidated input that gets directly embedded into SQL statements without proper parameterization or input sanitization. Attackers can craft payloads that cause the database to evaluate different boolean conditions, thereby observing varying application responses that reveal information about the database schema, table structures, and potentially sensitive data. This type of injection vulnerability falls under CWE-89 which specifically addresses SQL injection flaws where improper handling of user input leads to unauthorized database access. The Boolean-based nature of this injection means that attackers can systematically determine the truth value of database queries through response timing or content differences, making it particularly dangerous for information gathering and data exfiltration.
The operational impact of CVE-2025-50341 extends beyond simple data theft to encompass potential system compromise and business disruption. Successful exploitation could enable attackers to access confidential customer data, financial records, or proprietary business information stored within the Axelor application's database. The vulnerability's presence in version 5.2.4 suggests a regression or oversight in the application's security hardening processes, potentially affecting organizations that rely on this ERP platform for critical business operations. Given that Axelor is commonly used for enterprise resource planning, the exposure of sensitive business data could result in significant financial loss, regulatory compliance violations, and reputational damage. The vulnerability aligns with ATT&CK technique T1071.005 which covers application layer protocol manipulation, specifically targeting database interaction points within applications.
Mitigation strategies for this vulnerability should prioritize immediate patching of the affected Axelor version to address the root cause of the SQL injection flaw. Organizations must implement proper input validation and parameterized query execution throughout the application's database interaction components, particularly focusing on the _domain parameter handling. The implementation of web application firewalls and database activity monitoring systems can provide additional layers of protection by detecting and blocking suspicious query patterns. Security teams should also conduct comprehensive code reviews to identify similar input handling patterns that may be susceptible to injection attacks, ensuring that all user-supplied data undergoes proper sanitization before database interaction. Additionally, implementing principle of least privilege for database connections and regular security assessments can significantly reduce the potential impact of such vulnerabilities, as outlined in industry best practices for secure application development and maintenance protocols.