CVE-2025-59499
published 2025-11-11CVE-2025-59499: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
PriorityP263high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.10%
62.0th percentile
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server_2016_service_pack_3 | >= 13.0.0 < 13.0.6475.1 | 13.0.6475.1 |
| microsoft | microsoft_sql_server_2016_service_pack_3_azure_connect_feature_pack | >= 13.0.0 < 13.0.7070.1 | 13.0.7070.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.3515.1 | 14.0.3515.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.2095.1 | 14.0.2095.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0 < 15.0.2155.2 | 15.0.2155.2 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0.0 < 15.0.4455.2 | 15.0.4455.2 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0 < 16.0.1160.1 | 16.0.1160.1 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0.0 < 16.0.4222.2 | 16.0.4222.2 |
| microsoft | sql_server_2016 | >= 13.0.6300.2 < 13.0.6475.1 | 13.0.6475.1 |
| microsoft | sql_server_2016 | >= 13.0.7000.253 < 13.0.7070.1 | 13.0.7070.1 |
| microsoft | sql_server_2017 | >= 14.0.1000.169 < 14.0.2095.1 | 14.0.2095.1 |
| microsoft | sql_server_2017 | >= 14.0.3006.16 < 14.0.3515.1 | 14.0.3515.1 |
| microsoft | sql_server_2019 | >= 15.0.2000.5 < 15.0.2155.2 | 15.0.2155.2 |
| microsoft | sql_server_2019 | >= 15.0.4003.23 < 15.0.4455.2 | 15.0.4455.2 |
| microsoft | sql_server_2022 | >= 16.0.1000.6 < 16.0.1160.1 | 16.0.1160.1 |
| microsoft | sql_server_2022 | >= 16.0.4003.1 < 16.0.4222.2 | 16.0.4222.2 |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3 | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3_azure_connect_fea | — | — |
| msrc | microsoft_sql_server_2017_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2019_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2022_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker exploits the vulnerability by injecting arbitrary T-SQL commands via a crafted malicious database name — monitor SQL Server for anomalous or unexpected database name strings containing SQL metacharacters or T-SQL syntax. ↗
- →Successful exploitation grants the attacker the privileges of the process running the query (e.g., sysadmin) — alert on unexpected privilege escalation events or sysadmin-level actions originating from non-administrative sessions in SQL Server audit logs. ↗
- ·Exploitation requires an authorized (authenticated) attacker — unauthenticated remote exploitation is not possible; scope detection efforts on authenticated SQL Server sessions. ↗
- ·Exploit has not been publicly disclosed or observed in the wild as of advisory publication — classified as 'Exploitation Less Likely'. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pm2c-qc4c-h96f: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
ghsa_unreviewed·2025-11-11
CVE-2025-59499 [HIGH] CWE-89 GHSA-pm2c-qc4c-h96f: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Microsoft
Microsoft SQL Server Elevation of Privilege Vulnerability
vendor_msrc·2025-11-11·CVSS 8.8
CVE-2025-59499 [HIGH] CWE-89 Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
Description: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
FAQ: How could an attacker exploit the vulnerability?
An attacker could inject arbitrary T-SQL commands by crafting a malicious database name.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain the privileges of the process running the query. For example, if the process running the query containing a SQL injection is sysadmin, the attacker would gain sysadmin privileges.
FAQ: I am running SQL Server on my system. What action do I need to
No detection rules found.
No public exploits indexed.
2025-11-11
Published