Listen to this Post
CVE-2025-15625 is an unauthenticated SQL injection vulnerability affecting Sparx Systems’ Pro Cloud Server. The flaw resides in an undisclosed function within the application, which fails to properly neutralize special elements used in SQL commands (CWE-89). This allows a remote, unauthenticated attacker to inject arbitrary SQL statements into backend database queries. The issue stems from the application directly incorporating user-controllable input into SQL statements without adequate sanitization or parameterization. In specific scenarios, the vulnerable endpoint accepts crafted parameters that alter the structure of SQL queries, enabling the attacker to append malicious commands. The attack can be launched remotely over the network without any prior authentication or user interaction. Successful exploitation provides the attacker with the ability to read, modify, or delete any data within the database, leading to full compromise of data confidentiality, integrity, and availability. The vulnerability affects version 6.0.163 of the Pro Cloud Server, while fixed version 6.1 addresses this security gap. The CVE was published on April 17, 2026, with a CVSS v3 base score of 9.8 (Critical) and a CVSS v4 score of 9.5. The vulnerability was discovered by security researchers from Solita Oy (Pasi Orovuo, Henri Hämäläinen, and Samu Ahvenainen).
DailyCVE Form:
Platform: Sparx Pro Cloud Server
Version: 6.0.163
Vulnerability: Unauthenticated SQL Injection
Severity: Critical (CVSS 9.8)
date: 2026-04-17
Prediction: Patch expected 2026-Q4
What Undercode Say:
Shodan dork to identify potentially vulnerable instances
http."Pro Cloud Server" || http.html:"/procloudserver"
Nuclei template example to detect the SQLi vulnerability
id: CVE-2025-15625
info:
name: Sparx Pro Cloud Server Unauth SQLi
severity: critical
reference: https://nvd.nist.gov/vuln/detail/CVE-2025-15625
requests:
- method: GET
path:
- "{{BaseURL}}/vulnerable/endpoint?id=1'+AND+1=1--"
matchers:
- type: word
words:
- "syntax error"
part: body
Manual exploitation attempt with sqlmap
sqlmap -u "https://target.com/path?id=1" --level 5 --risk 3 --dbms=MySQL --batch
How Exploit:
An unauthenticated attacker sends a specially crafted HTTP request to the vulnerable endpoint, injecting SQL payload into a parameter (such as the `id` parameter). For example, appending `’ OR ‘1’=’1` to the parameter value alters the original SQL query logic, allowing the attacker to bypass authentication or extract database contents. A public proof-of-concept is not yet available, but the attack can be fully automated.
Protection:
- Immediately upgrade to Sparx Pro Cloud Server version 6.1 or later.
- If immediate patching is not possible, implement network-level access controls to restrict access to trusted networks.
- Deploy a Web Application Firewall (WAF) with SQL injection detection rules.
- Apply database-level least privilege principles and consider isolating critical instances.
Impact:
Successful exploitation leads to complete exposure of sensitive data (confidentiality HIGH), corruption or deletion of database records (integrity HIGH), and potential denial of service (availability HIGH). Attackers can fully compromise the Sparx Pro Cloud Server database, retrieve plaintext credentials from connected Enterprise Architect models, and pivot to other systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
