CVE-2025-8162 in deer-wms-2
Summary
by MITRE • 07/25/2025
A vulnerability, which was classified as critical, has been found in deerwms deer-wms-2 up to 3.3. Affected by this issue is some unknown functionality of the file /system/dept/list. The manipulation of the argument params[dataScope] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2025
This critical vulnerability exists within the deerwms deer-wms-2 web application version 3.3 and earlier, specifically targeting the /system/dept/list endpoint functionality. The flaw represents a classic sql injection vulnerability that occurs when the params[dataScope] parameter is improperly handled during processing. This vulnerability falls under the CWE-89 category of SQL Injection, which is classified as a critical weakness in web applications. The attack vector is remotely exploitable, meaning that malicious actors can leverage this vulnerability without requiring physical access to the system or local network privileges.
The technical implementation of this vulnerability allows attackers to inject malicious sql commands through the params[dataScope] argument, which is processed without proper input sanitization or parameterized query handling. When the application receives this parameter, it directly incorporates it into sql query construction without adequate validation or escaping mechanisms. This creates an environment where an attacker can manipulate the sql execution flow to extract sensitive data, modify database contents, or potentially gain unauthorized access to underlying database resources. The vulnerability's classification as critical indicates that it can be exploited without significant skill requirements and can lead to complete system compromise.
The operational impact of this vulnerability extends beyond simple data theft, as it provides attackers with the capability to perform arbitrary database operations. An attacker could potentially extract user credentials, manipulate departmental data, or even escalate privileges within the application. The public disclosure of the exploit means that threat actors can immediately leverage this vulnerability without needing to develop custom attack code. This exposure significantly increases the attack surface and creates immediate risk for all systems running affected versions of the deerwms deer-wms-2 application. Organizations using this software are particularly vulnerable as the exploit is readily available and the attack requires no specialized knowledge to implement.
Mitigation strategies should focus on immediate patching of the affected software to version 3.4 or later, which contains the necessary security fixes for this sql injection vulnerability. Additionally, implementing proper input validation and parameterized queries for all database interactions will prevent similar vulnerabilities from occurring. Network segmentation and web application firewalls can provide additional defense-in-depth measures. Organizations should also conduct comprehensive security assessments of their web applications to identify other potential sql injection vulnerabilities in their codebase. The vulnerability aligns with ATT&CK technique T1190 for exploit public-facing applications and T1071.004 for application layer protocol. Regular security monitoring and vulnerability scanning should be implemented to detect potential exploitation attempts and ensure ongoing protection against similar threats.