CVE-2025-49758
published 2025-08-12CVE-2025-49758: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.93%
56.5th percentile
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server_2016_service_pack_3 | >= 13.0.0 < 13.0.6465.1 | 13.0.6465.1 |
| microsoft | microsoft_sql_server_2016_service_pack_3_azure_connect_feature_pack | >= 13.0.0 < 13.0.7060.1 | 13.0.7060.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.3500.1 | 14.0.3500.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.2080.1 | 14.0.2080.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0 < 15.0.2140.1 | 15.0.2140.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0.0 < 15.0.4440.1 | 15.0.4440.1 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0 < 16.0.1145.1 | 16.0.1145.1 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0.0 < 16.0.4210.1 | 16.0.4210.1 |
| microsoft | sql_server_2016 | >= 13.0.6300.2 < 13.0.6465.1 | 13.0.6465.1 |
| microsoft | sql_server_2016 | >= 13.0.7000.253 < 13.0.7060.1 | 13.0.7060.1 |
| microsoft | sql_server_2017 | >= 14.0.1000.169 < 14.0.2080.1 | 14.0.2080.1 |
| microsoft | sql_server_2017 | >= 14.0.3006.16 < 14.0.3500.1 | 14.0.3500.1 |
| microsoft | sql_server_2019 | >= 15.0.2000.5 < 15.0.2140.1 | 15.0.2140.1 |
| microsoft | sql_server_2019 | >= 15.0.4003.23 < 15.0.4440.1 | 15.0.4440.1 |
| microsoft | sql_server_2022 | >= 16.0.1000.6 < 16.0.1145.1 | 16.0.1145.1 |
| microsoft | sql_server_2022 | >= 16.0.4003.1 < 16.0.4210.1 | 16.0.4210.1 |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3 | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3_azure_connect_fea | — | — |
| msrc | microsoft_sql_server_2017_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2019_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2022_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →An authenticated attacker with explicit permissions exploits SQL injection to elevate privileges to sysadmin on SQL Server over the network. Monitor for unexpected privilege escalation to sysadmin role by non-administrative SQL logins. ↗
- →Attacker gains administrator (sysadmin) privileges via SQL injection. Alert on IS_SRVROLEMEMBER('sysadmin') becoming true for accounts that were not previously sysadmin. ↗
- ·Exploitation requires an authenticated SQL Server account with explicit (non-default) permissions — unauthenticated or low-privilege accounts without explicit grants are not sufficient attack vectors. ↗
- ·Affected SQL Server versions span 2016 SP3 through 2022. Patched versions are: SQL 2022 ≥16.0.4210.1 (CU20+GDR) or ≥16.0.1145.1 (RTM+GDR); SQL 2019 ≥15.0.4440.1 (CU32+GDR) or ≥15.0.2140.1 (RTM+GDR); SQL 2017 ≥14.0.3500.1 (CU31+GDR) or ≥14.0.2080.1 (RTM+GDR); SQL 2016 SP3 ≥13.0.6465.1 (RTM+GDR) or ≥13.0.7060.1 (Azure Connect FP). Instances below these thresholds remain vulnerable. ↗
- ·Exploit status is 'Exploitation Less Likely' with no public exploit or in-the-wild exploitation confirmed at time of advisory publication. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4r6w-pg4g-qvvh: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
ghsa_unreviewed·2025-08-12
CVE-2025-49758 [HIGH] CWE-269 GHSA-4r6w-pg4g-qvvh: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Microsoft
Microsoft SQL Server Elevation of Privilege Vulnerability
vendor_msrc·2025-08-12·CVSS 8.8
CVE-2025-49758 [HIGH] CWE-269 Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
Description: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
FAQ: How could an attacker exploit this vulnerability?
An authenticated attacker with explicit permissions could exploit the vulnerability by logging in to the SQL server and could then elevate their privileges to sysadmin.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain administrator privileges.
FAQ: I am running SQL Server on my system. What action do I need to take?
Update your relevant version of SQL Server. Any applicable driver f
No detection rules found.
No public exploits indexed.
2025-08-12
Published