CVE-2025-66944

The vulnerability occurs in the query parameter of the search API endpoint in the Databasir application. An attacker can submit a specially crafted HTTP request containing a malicious SQL payload that is not properly filtered or parameterized by the application. This results in the execution of untrusted SQL code on the database server, and consequently the ability to execute arbitrary code at the operating system level (RCE).

An attacker can take full control of the database (read, modify, delete data) and potentially execute arbitrary code on the server, leading to complete compromise of system confidentiality, integrity, and availability.

Apply patches available from the vendor according to references. It is recommended to monitor the project repository (https://github.com/vran-dev/databasir/issues/283) for information about available fixes. Until the patch is installed, consider restricting access to the search API endpoint to trusted IP addresses at the firewall level.

Databasir (vran-dev) version 1.0.7 and all earlier versions