Listen to this Post
The CVE-2025-13757 vulnerability is a SQL injection flaw in the last usage logs functionality of Devolutions Server. It arises due to improper sanitization of user-supplied input when constructing SQL queries for retrieving usage log data. Attackers can exploit this by injecting malicious SQL code through parameters in HTTP requests, such as in query strings or POST data. This injected code is executed directly on the backend database server, allowing unauthorized access to sensitive information stored in the database, including user credentials, session tokens, and configuration details. The vulnerability affects versions where input validation is lacking, enabling attackers to manipulate SQL commands to read, modify, or delete data. Specifically, the flaw occurs in the code handling log retrieval, where concatenation of user input into SQL statements without parameterization leads to executable arbitrary SQL. This can result in full database compromise, bypassing authentication mechanisms, and potentially allowing remote code execution depending on database permissions. The issue is present in versions through 2025.2.20 and 2025.3.8, making it critical for organizations using these releases.
Platform: Devolutions Server
Version: 2025.2.20, 2025.3.8
Vulnerability: SQL Injection
Severity: Critical
Date: 11/27/2025
Prediction: Patch by 12/10/2025
What Undercode Say:
curl -X GET "https://target/devolutions/logs?user=admin' OR '1'='1" sqlmap -u "https://target/devolutions/logs" --data="user=admin" --dbs
SELECT FROM usage_logs WHERE user='admin' UNION SELECT username, password FROM users;
How Exploit:
Inject SQL payloads via user input parameters in last usage logs requests to extract database information or execute commands.
Protection from this CVE
Update to patched versions, implement input validation, use parameterized queries, and apply web application firewalls.
Impact:
Data breach, unauthorized access, potential system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
