SB2025081271 - Multiple vulnerabilities in Microsoft SQL Server
Published: August 12, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) SQL injection (CVE-ID: CVE-2025-49758)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in Microsoft SQL Server. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
2) SQL injection (CVE-ID: CVE-2025-47954)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in Microsoft SQL Server. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
3) SQL injection (CVE-ID: CVE-2025-49759)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in Microsoft SQL Server. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
4) Improper access control (CVE-ID: CVE-2025-24999)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in Microsoft SQL Server. A remote user can bypass implemented security restrictions and gain elevated privileges on the target system.
5) SQL injection (CVE-ID: CVE-2025-53727)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in Microsoft SQL Server. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-49758
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-47954
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-49759
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-24999
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-53727