Critical severity · published Sep 10, 2025
CVE-2025-9943
Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).
This issue affects Shibboleth Service Provider through 3.5.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Service Provider · Shibboleth
through 3.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9943
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9943
r.sec-consult.com
https://r.sec-consult.com/shibboleth
shibboleth.net
https://shibboleth.net/community/advisories/secadv_20250903.txt
shibboleth.net
https://shibboleth.net/downloads/service-provider/3.5.1/
seclists.org
http://seclists.org/fulldisclosure/2025/Sep/40
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/09/msg00015.html
More from Service Provider
8.1
CVE-2017-16852
shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the…
7.8
CVE-2019-19191
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after…
7.5
CVE-2021-31826
Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature
7.5
CVE-2010-2450
The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm
7.3
CVE-2023-22947
Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM…