SQL Injection in Diskoverdata Diskover
CVE-2025-50984
diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration form. Unsanitized user input in POST parameters such as ES_PASS, ES_MAXSIZE, ES_TRANSLOGSIZE, ES_TIMEOUT, ES_USER, ES_HOST, ES_PORT, ES_SCROLLSIZE, ES_CHUNKSIZE and others can be crafted to inject arbitrary SQLite expressions wrapped in JSON functions. By exploiting these injection points, an attacker can infer or extract sensitive information from the underlying database without authentication. This issue stems from improper input validation and parameterization in the application's JSON-based query construction.
Vulnerability class: SQL Injection
EPSS: 0.003 (25.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Diskoverdata Diskover — versions 2.3.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-50984?
- CVE-2025-50984 is a medium-severity vulnerability in Diskoverdata Diskover, classified under SQL Injection. CVSS score: 5.3/10. Published 2025-08-27.
- How severe is CVE-2025-50984?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2025-50984 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.