CVE-2025-47178

Published Jul 8, 2025

Last updated 2 months ago

Microsoft Configuration Manager

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-47178 is an SQL injection vulnerability affecting Microsoft Configuration Manager. Disclosed on July 8, 2025, it stems from improper neutralization of special elements within SQL commands. The vulnerability allows an authorized attacker with adjacent network access to execute code by injecting malicious SQL commands. Successful exploitation could lead to arbitrary SQL execution with elevated privileges, potentially enabling attackers to execute OS-level commands. Microsoft released security updates in July 2025 to address this vulnerability.

Description: Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: configuration_manager_2503

Risk scores

CVSS 3.1

Type: Primary
Base score: 8
Impact score: 5.9
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:configuration_manager_2503:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "325E8047-7EA2-47EA-87C3-3A5A6A081AA9",
            "versionEndExcluding": "5.00.9135.1003"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.