CVE-2025-28056

rebuild v3.9.0 through v3.9.3 has a SQL injection vulnerability in /admin/admin-cli/exec component

Critical · published May 13, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection vulnerability lurks in versions 3.9.0 through 3.9.3 of rebuild, ready to wreak havoc! 🔥 Think of it as a restaurant kitchen where a chef can change the entire menu just by slipping a note under the door — without anyone knowing what hit them! 🍽️ An attacker could exploit this vulnerability to execute malicious SQL commands, potentially compromising your entire database. This means they could access, modify, or even delete vital information, causing catastrophic damage to your system. If left unaddressed, the fallout could be absolutely devastating!

Put simply

Think of it as a restaurant kitchen where a chef can change the entire menu just by slipping a note under the door — without anyone knowing what hit them! 🍽️ The SQL injection vulnerability in the /admin/admin-cli/exec component allows attackers to manipulate database queries through unsanitized user input, leading to unauthorized access and data manipulation.

What to do

An attacker could exploit this vulnerability to execute malicious SQL commands, potentially compromising your entire database. This means they could access, modify, or even delete vital information, causing catastrophic damage to your system. If left unaddressed, the fallout could be absolutely devastating! Immediate action is crucial! Upgrade to rebuild version 3.9.4 or later to patch this vulnerability. Additionally, sanitize all inputs and implement prepared statements to bolster your defenses against future SQL injection attacks. You've got this! Follow these steps and you'll ensure your system is secure in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00448 · 38.0th percentile
Published
2025-05-13T00:00Z
EPSS history
Timeline
  • 13 MAY 00:00Z
    rebuild v3.9.0 through v3.9.3 has a SQL injection vulnerability in /admin/admin-cli/exec component
    cvelistv5