CVE-2025-58112

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-58112", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-19T14:42:28.552Z", "dateReserved": "2025-08-25T00:00:00.000Z", "datePublished": "2026-03-18T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-18T18:51:28.672Z"}, "descriptions": [{"lang": "en", "value": "Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .rdl (Report Definition Language) file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting Services Reports can upload a malicious rdl file. If the malicious rdl file is already loaded and it is executable by the user, the Add Reporting Services Reports privilege is not required. A malicious actor can trigger the generation of the report, causing the execution of arbitrary SQL commands in the underlying database. Depending on the permissions of the account running SQL Server Reporting Services, the attacker may be able to perform additional actions, such as accessing linked servers or executing operating system commands."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://microsoft.com"}, {"url": "https://gist.github.com/Redteam-LongwaveSpa/141f6c52ce49f9c0f49989c7d6940abd"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T14:41:23.119712Z", "id": "CVE-2025-58112", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:42:28.552Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-58112", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-19T14:41:23.119712Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:42:18.634Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://microsoft.com"}, {"url": "https://gist.github.com/Redteam-LongwaveSpa/141f6c52ce49f9c0f49989c7d6940abd"}], "descriptions": [{"lang": "en", "value": "Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .rdl (Report Definition Language) file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting Services Reports can upload a malicious rdl file. If the malicious rdl file is already loaded and it is executable by the user, the Add Reporting Services Reports privilege is not required. A malicious actor can trigger the generation of the report, causing the execution of arbitrary SQL commands in the underlying database. Depending on the permissions of the account running SQL Server Reporting Services, the attacker may be able to perform additional actions, such as accessing linked servers or executing operating system commands."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-18T18:51:28.672Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58112", "state": "PUBLISHED", "dateUpdated": "2026-03-19T14:42:28.552Z", "dateReserved": "2025-08-25T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-18T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .rdl (Report Definition Language) file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting Services Reports can upload a malicious rdl file. If the malicious rdl file is already loaded and it is executable by the user, the Add Reporting Services Reports privilege is not required. A malicious actor can trigger the generation of the report, causing the execution of arbitrary SQL commands in the underlying database. Depending on the permissions of the account running SQL Server Reporting Services, the attacker may be able to perform additional actions, such as accessing linked servers or executing operating system commands."}, {"lang": "es", "value": "Microsoft Dynamics 365 Customer Engagement (local) 1612 (9.0.2.3034) permite la generaci\u00f3n de informes personalizados a trav\u00e9s de consultas SQL sin procesar en una carga de un archivo .rdl (Report Definition Language); esto es luego procesado por el SQL Server Reporting Service. Una cuenta con el privilegio Agregar informes de Reporting Services puede cargar un archivo rdl malicioso. Si el archivo rdl malicioso ya est\u00e1 cargado y es ejecutable por el usuario, el privilegio Agregar informes de Reporting Services no es necesario. Un actor malicioso puede desencadenar la generaci\u00f3n del informe, causando la ejecuci\u00f3n de comandos SQL arbitrarios en la base de datos subyacente. Dependiendo de los permisos de la cuenta que ejecuta SQL Server Reporting Services, el atacante puede ser capaz de realizar acciones adicionales, como acceder a servidores vinculados o ejecutar comandos del sistema operativo."}], "id": "CVE-2025-58112", "lastModified": "2026-06-17T09:43:55.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58112", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T14:41:23.119712Z", "version": "2.0.3"}}]}, "published": "2026-03-18T19:16:03.497", "references": [{"source": "cve@mitre.org", "url": "https://gist.github.com/Redteam-LongwaveSpa/141f6c52ce49f9c0f49989c7d6940abd"}, {"source": "cve@mitre.org", "url": "https://microsoft.com"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.0.2.3034]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "dynamics_365_customer_service", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-03-19T16:26:32.105963+00:00", "value": {"mitigation_remediation": ["Restrict the Add Reporting Services Reports privilege to trusted users only.", "Validate or quarantine uploaded RDL files and prevent execution of unchecked SQL queries.", "Apply any available Microsoft patch or upgrade to Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 that addresses the issue; check the vendor\u2019s support site for updates.", "If the reporting feature is not required, consider disabling RDL upload functionality or restricting it to minimal permissions.", "Configure SQL Server Reporting Services to run with least privilege and limit access to linked servers and operating system commands."], "summary": {"action": "Assess Impact", "impact": "Remote SQL Injection"}, "threat_synthesis": {"affected_systems": "Affected product: Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034). The risk lies in the Reporting Services component that processes uploaded RDL files. No additional affected product versions are listed.", "description_and_impact": "Microsoft Dynamics 365 Customer Engagement (on-premises) version 1612 (9.0.2.3034) allows an attacker to upload a malicious RDL (Report Definition Language) file that contains raw SQL queries. When the Reporting Service processes the uploaded file, it executes the embedded SQL under the permissions of the SQL Server Reporting Services account. The vulnerability is a classic SQL Injection flaw (CWE\u201189) and can lead to arbitrary data manipulation, untrusted data exposure, and, depending on the Reporting Services account rights, execution of linked server commands or even operating system commands. The impact is therefore high: confidentiality, integrity, and potential availability of the underlying database and, if broader privileges exist, the host server.", "risk_and_exploitability": "The CVSS score is 8.8, indicating a high severity vulnerability. The EPSS score is less than 1%, suggesting a low current exploit likelihood, and the issue is not listed in CISA\u2019s KEV catalog. The attack requires the ability to upload or execute an RDL file with the Add Reporting Services Reports privilege, or if the file is already loaded and executable, privilege escalation is not mandatory. These conditions imply that the exploit vector is most likely remote via the web interface that manages reports, but it could also be local if an attacker gains file upload access. The actual exploitation path is clearly stated in the vendor description; no additional inference is needed beyond the stated conditions."}}}}, "created": "2026-03-19T08:56:55.267024+00:00", "title": "Microsoft Dynamics 365 Customer Engagement on\u2011premises Remote SQL Injection via Malicious RDL File", "updated": "2026-03-24T10:53:56.468982+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$dynamics_365_customer_service"]}