CVE-2025-49759
published 2025-08-12CVE-2025-49759: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.10%
62.3th percentile
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server_2016_service_pack_3 | >= 13.0.0 < 13.0.6465.1 | 13.0.6465.1 |
| microsoft | microsoft_sql_server_2016_service_pack_3_azure_connect_feature_pack | >= 13.0.0 < 13.0.7060.1 | 13.0.7060.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.3500.1 | 14.0.3500.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.2080.1 | 14.0.2080.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0 < 15.0.2140.1 | 15.0.2140.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0.0 < 15.0.4440.1 | 15.0.4440.1 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0 < 16.0.1145.1 | 16.0.1145.1 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0.0 < 16.0.4210.1 | 16.0.4210.1 |
| microsoft | sql_server_2016 | >= 13.0.6300.2 < 13.0.6465.1 | 13.0.6465.1 |
| microsoft | sql_server_2016 | >= 13.0.7000.253 < 13.0.7060.1 | 13.0.7060.1 |
| microsoft | sql_server_2017 | >= 14.0.1000.169 < 14.0.2080.1 | 14.0.2080.1 |
| microsoft | sql_server_2017 | >= 14.0.3006.16 < 14.0.3500.1 | 14.0.3500.1 |
| microsoft | sql_server_2019 | >= 15.0.2000.5 < 15.0.2140.1 | 15.0.2140.1 |
| microsoft | sql_server_2019 | >= 15.0.4003.23 < 15.0.4440.1 | 15.0.4440.1 |
| microsoft | sql_server_2022 | >= 16.0.1000.6 < 16.0.1145.1 | 16.0.1145.1 |
| microsoft | sql_server_2022 | >= 16.0.4003.1 < 16.0.4210.1 | 16.0.4210.1 |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3 | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3_azure_connect_fea | — | — |
| msrc | microsoft_sql_server_2017_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2019_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2022_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is exploited by injecting arbitrary T-SQL commands via a crafted malicious database name — monitor SQL Server audit logs for unusual or malformed database name strings containing SQL metacharacters (quotes, semicolons, comment sequences) in connection or DDL events. ↗
- →The attack vector is network-based and requires an authorized (authenticated) attacker — focus detection on privilege escalation events (e.g., unexpected sysadmin role grants, EXECUTE AS, or impersonation calls) originating from non-administrative logins over the network. ↗
- →Successful exploitation results in administrator-level privileges — alert on unexpected additions to the sysadmin fixed server role or sudden privilege changes for previously low-privileged SQL logins. ↗
- ·Patched versions are available for SQL Server 2016 SP3, 2017, 2019, and 2022 across both GDR and CU servicing paths; unpatched instances on any of these versions remain vulnerable. SQL Server versions not listed in the patch table are end-of-life and will not receive fixes. ↗
- ·Once a SQL Server CU update is applied, reverting to the GDR update path is not possible — patch path selection is irreversible and must be planned carefully. ↗
- ·The vulnerability has not been publicly disclosed or exploited in the wild at time of advisory publication, but exploitation is rated 'Less Likely' — still warrants prompt patching given the EoP impact and network attack vector. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft SQL Server Elevation of Privilege Vulnerability
vendor_msrc·2025-08-12·CVSS 8.8
CVE-2025-49759 [HIGH] CWE-89 Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
Description: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain administrator privileges.
FAQ: How could an attacker exploit the vulnerability?
An attacker could inject arbitrary T-SQL commands by crafting a malicious database name.
FAQ: I am running SQL Server on my system. What action do I need to take?
Update your relevant version of SQL Server. Any applicable driver fixes are included in those updates.
There are GDR and/or CU (Cumulative Update) u
GHSA
GHSA-hwf4-qmx5-35cv: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
ghsa_unreviewed·2025-08-12
CVE-2025-49759 [HIGH] CWE-89 GHSA-hwf4-qmx5-35cv: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
No detection rules found.
No public exploits indexed.
2025-08-12
Published