CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2025-29085Public Exploit

vipshop Saturn - SQLi (CVE-2025-29085)

PublishedApr 2, 2025
First SeenMay 29, 2025
Last Seen
Reported
CVSS9.8
vipshop
vipshopSaturn
web_application

Description

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.

psychologyCrowdSec Analysis

CVE-2025-29085 is a critical SQL injection vulnerability in the Saturn platform that could allow remote attackers to execute arbitrary code by manipulating requests to the dashboard interface.

CrowdSec has been tracking this vulnerability and its exploits since 28th of May 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-29085 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-29085 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Observed exploitation attempts are focused on URLs containing /console/dashboard/executorcount.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2025-04-02
Rule Released2025-05-28
CrowdSec First Seen2025-05-29

Related Weaknesses

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References