CVE-2025-15597
A vulnerability has been found in Dataease SQLBot up to 1.4.0.
Does this matter?
Lower severity and a low EPSS score (0.55%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.55% probability · 44th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-266, CWE-284
- Affected
- fit2cloud/sqlbot
- Source
- cna@vuldb.com
References
- https://github.com/dataease/SQLBot/Product
- https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc28cPatch
- https://github.com/dataease/SQLBot/releases/tag/v1.5.0Release Notes
- https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6rExploit, Vendor Advisory
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.mdExploit, Third Party Advisory
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.348291Permissions Required, VDB Entry
- https://vuldb.com/?id.348291Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.706144Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707283Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707284Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707285Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707286Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707288Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707293Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707294Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707295Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.