Google Looker Studio prior 2025-07-07 sql injection

Summaryinfo

A vulnerability was found in Google Looker Studio. It has been classified as critical. This issue affects some unknown processing. Performing a manipulation results in sql injection. This vulnerability is known as CVE-2025-12409. Remote exploitation of the attack is possible. No exploit is available. This product is a managed service, so users do not have direct control over vulnerability countermeasures. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Google Looker Studio. It has been classified as critical. This affects an unknown code block. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery. This vulnerability was patched on 07 July 2025, and no customer action is needed.

The weakness was published by Liv Matan as gcp-2025-053. The advisory is shared at cloud.google.com. This vulnerability is uniquely identified as CVE-2025-12409 since 10/28/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/10/2025). MITRE ATT&CK project uses the attack technique T1505 for this issue.

Upgrading to version 2025-07-07 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-44038). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Google

Name

• Looker Studio

License

• free

Managed Service

• yes

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion