CVE-2025-10968: PaperWork SQL Injection Vulnerability

CVE-2025-10968 Overview

CVE-2025-10968 is a SQL injection vulnerability affecting GG Soft Software Services Inc. PaperWork. The flaw stems from improper neutralization of special elements in SQL commands within Hibernate-based queries. Authenticated attackers can exploit both classic and blind SQL injection techniques over the network. The vulnerability affects PaperWork versions from 6.1.0.9390 before 6.1.0.9398. The issue is classified under CWE-89 and was published to the National Vulnerability Database on November 7, 2025. Turkish national cybersecurity authorities issued advisories tracking this issue under reference TR-25-0381.

Critical Impact
Authenticated attackers can extract, modify, or destroy database contents through SQL injection, with full confidentiality, integrity, and availability impact on the backend database.

Affected Products

GG Soft Software Services Inc. PaperWork 6.1.0.9390
GG Soft Software Services Inc. PaperWork versions through 6.1.0.9397
Hibernate-backed database query components within PaperWork

Discovery Timeline

2025-11-07 - CVE-2025-10968 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10968

Vulnerability Analysis

The vulnerability resides in PaperWork's data access layer, which uses the Hibernate Object-Relational Mapping (ORM) framework. User-supplied input reaches SQL query construction without proper neutralization of special characters. This enables attackers to manipulate query logic by injecting SQL syntax through application input fields.

The flaw supports both error-based SQL injection and blind SQL injection. Blind injection allows extraction of data through boolean or time-based inference when query output is not returned to the attacker. The vulnerability requires low-privilege authentication and can be triggered remotely over the network without user interaction.

Successful exploitation yields complete compromise of the backing database. Attackers can read sensitive records, alter stored data, and disrupt application availability through destructive queries.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. PaperWork concatenates or interpolates untrusted input into Hibernate Query Language (HQL) or native SQL statements without parameterized queries or prepared statements. Hibernate provides safe binding mechanisms, but the affected code paths bypass them.

Attack Vector

An authenticated attacker submits crafted input containing SQL metacharacters to a vulnerable PaperWork endpoint. The application embeds the input into a query string passed to Hibernate. The injected payload alters the intended SQL semantics, triggering attacker-controlled query execution against the backend database. Blind variants use conditional response timing or boolean differentials to exfiltrate data byte by byte.

No verified proof-of-concept code is publicly available. Technical details are referenced in the USOM Security Notification TR-25-0381 and the Siber Güvenlik Security Notification.

Detection Methods for CVE-2025-10968

Indicators of Compromise

Unexpected SQL syntax patterns such as UNION SELECT, OR 1=1, SLEEP(, or WAITFOR DELAY in PaperWork application request logs
Anomalous database query execution times indicating time-based blind injection probes
Database error messages logged by Hibernate referencing malformed SQL or unexpected query structures
Unusual outbound data volumes from the PaperWork application or database tier

Detection Strategies

Monitor HTTP request parameters submitted to PaperWork endpoints for SQL metacharacters and known injection payloads
Inspect Hibernate and database logs for query patterns inconsistent with normal application behavior
Deploy web application firewall (WAF) rules targeting SQL injection signatures on PaperWork traffic
Correlate authentication events with subsequent anomalous database activity from the same user session

Monitoring Recommendations

Enable verbose query logging on the database server hosting PaperWork data
Alert on database errors returning to authenticated user sessions
Track row-count anomalies on sensitive tables accessed by PaperWork service accounts
Forward PaperWork application and database logs to a centralized SIEM for retention and correlation

How to Mitigate CVE-2025-10968

Immediate Actions Required

Upgrade PaperWork to version 6.1.0.9398 or later as released by GG Soft Software Services Inc.
Audit PaperWork user accounts and revoke unnecessary access to limit the population of potential attackers
Review database audit logs for evidence of prior injection attempts dating back to the introduction of version 6.1.0.9390
Rotate credentials and secrets stored in the PaperWork database if compromise is suspected

Patch Information

GG Soft Software Services Inc. addressed the vulnerability in PaperWork version 6.1.0.9398. Organizations running versions from 6.1.0.9390 through 6.1.0.9397 must upgrade. Refer to the USOM Security Notification for vendor coordination details.

Workarounds

Restrict network access to PaperWork to trusted internal users and VPN clients until patching completes
Deploy a web application firewall with SQL injection signatures in front of PaperWork
Apply least-privilege database permissions to the PaperWork service account to limit the impact of successful injection
Disable or restrict PaperWork user accounts that do not require active access during the patch window

bash

# Example WAF rule concept for blocking common SQL injection patterns
# Tune to your environment before deploying in blocking mode
SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|waitfor\s+delay|or\s+1=1)" \
    "id:1010968,phase:2,deny,status:403,log,msg:'Potential SQLi targeting PaperWork CVE-2025-10968'"