CVE-2025-22953

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting malicious SQL payloads into the filter parameter, enabling the unauthorized execution of arbitrary SQL commands on the backend database. If certain features (like xp_cmdshell) are enabled, this may lead to remote code execution.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/maliktawfiq/CVE-2025-22953
https://tinted-hollyhock-92d.notion.site/EPICOR-HCM-Unauthenticated-Blind-SQL-Injection-CVE-2025-22953-170f1fdee211803988d1c9255a8cb904?pvs=4	Third Party Advisory
https://www.epiusers.help/t/alert-hcm-security-patch/124777

Configurations

Configuration 1 (hide)

cpe:2.3:a:epicor:human_capital_management:2021_1.9:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-28 21:15

Updated : 2025-04-15 15:16

NVD link : CVE-2025-22953

Mitre link : CVE-2025-22953

CVE.ORG link : CVE-2025-22953

JSON object : View

Products Affected

epicor

human_capital_management

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-22953", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-03-28T21:15:17.617", "references": [{"url": "https://github.com/maliktawfiq/CVE-2025-22953", "source": "cve@mitre.org"}, {"url": "https://tinted-hollyhock-92d.notion.site/EPICOR-HCM-Unauthenticated-Blind-SQL-Injection-CVE-2025-22953-170f1fdee211803988d1c9255a8cb904?pvs=4", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.epiusers.help/t/alert-hcm-security-patch/124777", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting malicious SQL payloads into the filter parameter, enabling the unauthorized execution of arbitrary SQL commands on the backend database. If certain features (like xp_cmdshell) are enabled, this may lead to remote code execution."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n SQL en Epicor HCM 2021 1.9, espec\u00edficamente en el par\u00e1metro de filtro del endpoint JsonFetcher.svc. Un atacante puede explotar esta vulnerabilidad inyectando cargas SQL maliciosas en el par\u00e1metro de filtro, lo que permite la ejecuci\u00f3n no autorizada de comandos SQL arbitrarios en la base de datos del backend. Si se habilitan ciertas funciones (como xp_cmdshell), esto puede provocar la ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2025-04-15T15:16:07.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:epicor:human_capital_management:2021_1.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A767A345-B0E9-40B9-91A7-BD5090999D01"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}