CVE Intelligence
Analysis AI-assisted

CVE-2025-57529: YouDataSum CPAS Audit Management System SQL Injection

CVE-2025-57529 is a critical SQL injection weakness (CWE-89) in the YouDataSum CPAS Audit Management System, affecting versions up to and including 4.9 according to the record. The CVSS 3.1 base score is 9.8, and the record describes possible unauthenticated remote access with unauthorized data access as the consequence. No confirmed exploitation in the wild appears in the sources consulted, but two repository references tagged as exploit-related are present, so affected deployments should be prioritized.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The YouDataSum CPAS Audit Management System is affected by an SQL injection weakness classified as CWE-89. According to the record, input is not validated sufficiently before it is used in database queries, and the affected versions are listed as up to and including 4.9.

Impact

  • The record states that a remote attacker without authentication may be able to execute arbitrary SQL commands.
  • Successful exploitation could lead to unauthorized access to data.
  • The CVSS 3.1 base score is 9.8 (critical), and the vector lists high impact on confidentiality, integrity and availability.

Affected products and versions

  • YouDataSum CPAS Audit Management System, versions up to and including 4.9, as listed in the record.
  • The record lists no fixed version. This does not mean that no fix exists; it means the information is unavailable in the consulted data.

Exploitation status

  • The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted.
  • Two GitHub references are tagged as exploit-related in the record. Their content was not verified here, but their presence suggests that public exploit-related material may exist.

Remediation and mitigation

  • Identify all deployments of the product and confirm their versions.
  • Restrict network exposure of the management application, for example through VPN access or an allowlist of trusted networks.
  • Monitor vendor communications and apply an official fix when one is published.
  • Apply least privilege to the database accounts used by the application to reduce the impact of a successful injection.
  • Consider a web application firewall only as a compensating control while a fix is pending, not as a replacement for remediation.

Detection guidance

  • Review web server and application logs for malformed or unusual parameter values sent to the affected application paths, and for database errors that follow such requests.
  • Monitor the application's database activity for unexpected queries or unusually large data exports.

Limitations of the available information

  • The record does not include a vendor advisory, a fixed version or patch details.
  • The exact parameter involved is not specified in the record.
  • EPSS and SSVC data are not available in the record, so their values are unknown.
  • Whether the vendor has responded or issued a fix is unknown from the sources consulted.

Frequently asked questions

Is CVE-2025-57529 known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. Two repository references are tagged as exploit-related, so the risk should still be treated seriously.

Which versions of the YouDataSum CPAS system are affected?

The record lists versions up to and including 4.9. No fixed version is given in the record, so the availability of a fix is unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.