CVE-2025-15625

The SQL injection vulnerability (CWE-89) allows an attacker to inject malicious SQL instructions into queries directed at the application database. Lack of proper validation or parameterization of input data enables execution of arbitrary SQL commands without the need for authentication. Additionally, the CWE-200 vulnerability indicates the possibility of unauthorized disclosure of sensitive information stored in the database.

An attacker can read, modify, or delete data from the application database, and under favorable conditions gain broader access to the system. It is also possible to disclose sensitive information stored in the Sparx Pro Cloud Server database.

Apply patches available from the manufacturer according to the references — a detailed list of patched versions is available in the Sparx Pro Cloud Server change history at: https://sparxsystems.com/products/procloudserver/6.1/history.html

Sparx Pro Cloud Server — versions indicated in the manufacturer's references (change history available at sparxsystems.com/products/procloudserver/6.1/history.html)