CVE-2025-22953 Overview
A critical SQL injection vulnerability has been identified in Epicor Human Capital Management (HCM) 2021 version 1.9. This vulnerability exists in the filter parameter of the JsonFetcher.svc endpoint, allowing unauthenticated attackers to inject malicious SQL payloads and execute arbitrary SQL commands on the backend database. When certain database features such as xp_cmdshell are enabled, this vulnerability can escalate to remote code execution, significantly increasing the potential impact.
Critical Impact
Unauthenticated attackers can execute arbitrary SQL commands on the backend database, potentially leading to data theft, data manipulation, or complete system compromise via remote code execution if xp_cmdshell is enabled.
Affected Products
- Epicor Human Capital Management 2021 version 1.9
- Epicor HCM versions prior to patched releases (5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, 5.18.0.573/HCM2024)
Discovery Timeline
- 2025-03-28 - CVE-2025-22953 published to NVD
- 2025-04-15 - Last updated in NVD database
Technical Details for CVE-2025-22953
Vulnerability Analysis
This SQL injection vulnerability (CWE-89) allows remote attackers to manipulate SQL queries through the filter parameter in the JsonFetcher.svc endpoint. The vulnerability is classified as an unauthenticated blind SQL injection, meaning attackers do not require any credentials to exploit it and must infer information from the application's behavior rather than direct output.
The attack requires no user interaction and can be executed remotely over the network. Once exploited, attackers gain the ability to read, modify, or delete data within the database. In environments where extended stored procedures like xp_cmdshell are enabled on the SQL Server, attackers can leverage this SQL injection to execute operating system commands, escalating the vulnerability to full remote code execution.
Root Cause
The root cause of this vulnerability is improper input validation and sanitization of user-supplied data in the filter parameter. The application fails to properly parameterize SQL queries, allowing attacker-controlled input to be directly concatenated into SQL statements executed against the backend database. This represents a classic SQL injection flaw where untrusted data is not adequately separated from query logic.
Attack Vector
The attack targets the JsonFetcher.svc endpoint, which accepts a filter parameter that is vulnerable to SQL injection. An attacker can craft malicious HTTP requests containing SQL payloads within this parameter. Because the vulnerability is blind, attackers typically use time-based or boolean-based techniques to extract data or confirm successful injection.
The exploitation flow involves:
- Identifying the vulnerable JsonFetcher.svc endpoint
- Crafting SQL injection payloads targeting the filter parameter
- Using blind SQL injection techniques (time-based delays or conditional responses) to extract sensitive data
- Optionally leveraging database features like xp_cmdshell to achieve remote code execution on the underlying server
For detailed technical analysis and proof-of-concept information, refer to the SQL Injection Analysis and the GitHub PoC Repository.
Detection Methods for CVE-2025-22953
Indicators of Compromise
- Unusual or malformed requests to the JsonFetcher.svc endpoint containing SQL syntax in the filter parameter
- Database queries with unexpected execution times indicating time-based blind SQL injection attempts
- Evidence of xp_cmdshell execution or attempts to enable this feature
- Unexpected data exfiltration or modifications in the HCM database
Detection Strategies
- Deploy web application firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests to the JsonFetcher.svc endpoint
- Enable SQL Server auditing to log and alert on suspicious query patterns, including attempts to use xp_cmdshell
- Monitor IIS logs for requests containing SQL injection indicators such as UNION SELECT, WAITFOR DELAY, or single quote characters in the filter parameter
- Implement network intrusion detection signatures for known SQL injection attack patterns
Monitoring Recommendations
- Configure alerting for failed or anomalous database queries originating from the HCM application
- Monitor for new user account creation or privilege escalation within the database that could indicate post-exploitation activity
- Enable verbose logging on the Epicor HCM application to capture detailed request information
- Implement database activity monitoring to track queries executed against sensitive tables
How to Mitigate CVE-2025-22953
Immediate Actions Required
- Apply the appropriate security patch immediately: 5.16.0.1033 for HCM2022, 5.17.0.1146 for HCM2023, or 5.18.0.573 for HCM2024
- Review the EPI Users Security Alert for official patch guidance
- Audit database logs for any evidence of exploitation prior to patching
- Ensure xp_cmdshell and other dangerous extended stored procedures are disabled on the SQL Server hosting the HCM database
Patch Information
Epicor has released security patches to address this vulnerability. Organizations should upgrade to the following patched versions based on their deployment:
- HCM2022: Version 5.16.0.1033
- HCM2023: Version 5.17.0.1146
- HCM2024: Version 5.18.0.573
Contact Epicor support or refer to the EPI Users Security Alert for patch download and installation instructions.
Workarounds
- Implement a web application firewall (WAF) rule to block requests containing SQL injection patterns in the filter parameter of JsonFetcher.svc
- Restrict network access to the HCM application to trusted IP ranges only until patches can be applied
- Disable xp_cmdshell and other extended stored procedures on the SQL Server to limit the impact if exploitation occurs
- Apply the principle of least privilege to the database account used by the HCM application to minimize potential damage from SQL injection
# Disable xp_cmdshell on SQL Server to limit RCE risk
sqlcmd -S localhost -Q "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
