cbcvebase.
CVE-2025-47172
published 2025-06-10

CVE-2025-47172: Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute…

PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.56%
72.7th percentile
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Affected

9 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_sharepoint_enterprise_server_2016>= 16.0.0 < 16.0.5504.100116.0.5504.1001
microsoftmicrosoft_sharepoint_server_2019>= 16.0.0 < 16.0.10417.2001816.0.10417.20018
microsoftmicrosoft_sharepoint_server_subscription_edition>= 16.0.0 < 16.0.18526.2039616.0.18526.20396
microsoftsharepoint_enterprise_server
microsoftsharepoint_server<= 16.0.18526.20396
microsoftsharepoint_server
msrcmicrosoft_sharepoint_enterprise_server_2016
msrcmicrosoft_sharepoint_server_2019
msrcmicrosoft_sharepoint_server_subscription_edition

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability requires a minimum of Site Member permissions (PR:L) — monitor for authenticated low-privileged users performing unusual or high-volume SQL-like activity against SharePoint Server endpoints over the network.
  • Attack vector is network-based; focus detection on inbound HTTP/S requests to SharePoint Server from authenticated sessions that contain SQL injection payloads in request parameters or POST bodies.
  • CVE-2025-47172 is classified as SQL Injection leading to RCE in Microsoft Office SharePoint — prioritize alerting on anomalous SQL syntax (e.g., stacked queries, EXEC/xp_cmdshell patterns) appearing in SharePoint ULS/IIS logs.
  • ·Exploit status is currently 'Exploitation Less Likely' and not publicly disclosed — no active exploitation observed at time of advisory publication; patch applicability should be validated against specific SharePoint Server versions using the referenced KB articles (5002732, 5002729, 5002736).
  • ·Customer action is required — patching is not automatic; administrators must manually apply the relevant update packages referenced in the advisory.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.