Vulnerability Description
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fit2Cloud | Sqlbot | < 1.5.0 |
Related Weaknesses (CWE)
References
- https://github.com/dataease/SQLBot/Product
- https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc2Patch
- https://github.com/dataease/SQLBot/releases/tag/v1.5.0Release Notes
- https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6rExploitVendor Advisory
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-ExploitThird Party Advisory
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-BroExploitThird Party Advisory
- https://vuldb.com/?ctiid.348291Permissions RequiredVDB Entry
- https://vuldb.com/?id.348291Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.706144Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.707283Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.707284Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.707285Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.707286Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.707288Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.707293Third Party AdvisoryVDB Entry
FAQ
What is CVE-2025-15597?
CVE-2025-15597 is a vulnerability with a CVSS score of 6.3 (MEDIUM). A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads ...
How severe is CVE-2025-15597?
CVE-2025-15597 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-15597?
Check the references section above for vendor advisories and patch information. Affected products include: Fit2Cloud Sqlbot.