🛡️ Yoosee Security Advisory
CVE-2025-52085 SQL Injection Vulnerability Fix Statement
✅ Vulnerability Status: Fixed
This vulnerability has been fixed through server-side remediation. No APP update is required. All users are now automatically protected.
This vulnerability has been fixed through server-side remediation. No APP update is required. All users are now automatically protected.
I. Vulnerability Overview
| CVE ID | CVE-2025-52085 |
|---|---|
| Vulnerability Type | SQL Injection (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) |
| Affected Product | Yoosee Cloud Service (Backend API) |
| Affected Scope | Yoosee APP v6.32.4 and earlier versions' backend API endpoints |
| Fix Method | Server-side fix (cloud hot update, no APP release required) |
| Severity | High (requires authenticated user privileges) |
| CVSS Score | 8.8 (High) |
| Discovery | Reported by external security researcher |
II. Vulnerability Description
Vulnerable Location: Yoosee APP Backend API Endpoints
Description:
Yoosee cloud backend API has an SQL injection vulnerability. An authenticated user can execute arbitrary SQL queries by sending maliciously crafted requests to specific API endpoints. This vulnerability exists on the server side and is unrelated to the APP client version.
Potential Impact:
- Database server information leakage (version, banner, etc.)
- Current database user and schema information leakage
- Database management system user privilege information leakage
- Unauthorized data reading from arbitrary tables
Attack Prerequisites:
- Attacker must have a valid Yoosee account (authenticated status)
- Needs to construct specific malicious request parameters
III. Remediation Measures
Fixed Server-side Remediation
All fixes were completed server-side, no APP client update is required, and the fix takes effect immediately covering all users.
- Parameterized Queries (Prepared Statements)
All backend database queries have been converted to parameterized queries, completely eliminating SQL injection risks. User input is no longer directly concatenated into SQL statements. - Input Validation and Filtering
Strict validation and whitelist filtering have been added to input parameters for all API endpoints, rejecting illegal characters and special SQL syntax. - Principle of Least Privilege
Database connection account privileges have been restricted to the minimum required for the application, limiting data access scope. - WAF Protection Rules
SQL injection detection rules have been added at the Web Application Firewall layer as a supplementary defense-in-depth measure. - Security Audit Logs
Enhanced database operation audit logs for abnormal behavior detection and post-incident tracing.
IV. Remediation Timeline
Vulnerability Report Received — June 26, 2025
Received vulnerability report from external security researcher, confirmed existence and
impact scope
Emergency Response Initiated
Security team initiated emergency response procedures for vulnerability reproduction and
risk assessment
Vulnerability Fix Development
Development team completed code fixes, implementing parameterized query transformation and
input validation
Security Testing and Verification
Security team conducted penetration testing, confirmed vulnerability is completely fixed
with no residual risk
Server-side Fix Deployed — 2025
Fix code deployed to production environment, cloud hot update takes effect immediately, no
APP release required
CVE ID Assigned
Obtained CVE-2025-52085 ID, vulnerability information entered into public vulnerability
database