SQL Injection Vulnerability in YouDataSum CPAS Audit Management System
CVE-2025-57529

9.8CRITICAL

Key Information:

Vendor

YouDataSum

Status
CPAS Audit Management System
Vendor
CVE Published:
3 February 2026

What is CVE-2025-57529?

The YouDataSum CPAS Audit Management System version 4.9 and earlier is susceptible to SQL Injection through inadequate input validation in the /cpasList/findArchiveReportByDah endpoint. This vulnerability enables remote, unauthenticated attackers to forge malicious SQL queries by manipulating input parameters. As a result, successful exploitation may permit unauthorized access to sensitive data, compromising the integrity and confidentiality of the system.

References

https://github.com/songqb-xx/CPAS-bug
https://github.com/songqb-xx/CVE-2025-57529/blob/main/REA...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.