CVE-2025-47954
published 2025-08-12CVE-2025-47954: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.35%
68.3th percentile
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server_2022 | >= 16.0.0 < 16.0.1145.1 | 16.0.1145.1 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0.0 < 16.0.4210.1 | 16.0.4210.1 |
| microsoft | sql_server_2022 | >= 16.0.1000.6 < 16.0.1145.1 | 16.0.1145.1 |
| microsoft | sql_server_2022 | >= 16.0.4003.1 < 16.0.4210.1 | 16.0.4210.1 |
| msrc | microsoft_sql_server_2022_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker must be an authorized (authenticated) SQL Server user to exploit; monitor for privilege escalation to sysadmin role from non-sysadmin logins following unusual SQL activity ↗
- →Monitor for unexpected sysadmin role membership changes (e.g., IS_SRVROLEMEMBER('sysadmin') returning 1 for accounts that should not have that privilege) ↗
- →Exploitation vector is network-based; monitor for anomalous SQL Server network connections from authenticated but low-privileged accounts performing privilege-escalating operations ↗
- ·Once a SQL Server CU update is applied, reverting to the GDR update path is not possible; choose the correct servicing track before patching ↗
- ·As of advisory publication, the vulnerability has not been publicly disclosed or exploited in the wild, but exploitation is rated 'Less Likely' — patch prioritization should still account for the sysadmin privilege gain impact ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft SQL Server Elevation of Privilege Vulnerability
vendor_msrc·2025-08-12·CVSS 8.8
CVE-2025-47954 [HIGH] CWE-89 Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
Description: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
FAQ: How could an attacker exploit the vulnerability?
An attacker could use the unsanitized parameter into a SQL query to trigger SQL Injection.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain sysadmin privileges.
FAQ: I am running SQL Server on my system. What action do I need to take?
Update your relevant version of SQL Server. Any applicable driver fixes are included in those updates.
There are GDR and/or CU (Cumulative Update) upda
GHSA
GHSA-x4cr-27fg-rx32: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
ghsa_unreviewed·2025-08-12
CVE-2025-47954 [HIGH] CWE-89 GHSA-x4cr-27fg-rx32: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
No detection rules found.
No public exploits indexed.
2025-08-12
Published