CVE-2025-24290: UISP Application SQLi Vulnerability

CVE-2025-24290 Overview

CVE-2025-24290 identifies multiple authenticated SQL Injection vulnerabilities in the Ubiquiti UISP (Ubiquiti Internet Service Provider) application affecting version 2.4.206 and earlier. These vulnerabilities allow a malicious actor with low privileges to craft malicious SQL queries that can bypass authentication controls and escalate privileges within the application. This represents a significant security risk for organizations relying on UISP for network management and service provider operations.

Critical Impact

Authenticated attackers with minimal privileges can exploit SQL Injection flaws to escalate privileges, potentially gaining full administrative control over the UISP application and underlying database systems.

Affected Products

• Ubiquiti UISP Application version 2.4.206 and earlier
• UISP deployments accessible over network interfaces
• All UISP installations running vulnerable versions without applied patches

Discovery Timeline

• 2025-06-29 - CVE-2025-24290 published to NVD
• 2025-06-30 - Last updated in NVD database

Technical Details for CVE-2025-24290

Vulnerability Analysis

This vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The UISP application fails to properly sanitize user-supplied input in multiple locations, allowing authenticated users to inject arbitrary SQL commands into database queries.

What makes this vulnerability particularly dangerous is the privilege escalation vector. Even users with low-level access to the UISP application can craft malicious input that manipulates SQL queries executed by the application. This can lead to unauthorized data access, modification of database records, or complete takeover of administrative functions.

The network-based attack vector means that any authenticated user with network access to the UISP application can potentially exploit these vulnerabilities without requiring physical access or complex attack chains.

Root Cause

The root cause of CVE-2025-24290 lies in improper input validation and inadequate sanitization of user-supplied data before it is incorporated into SQL queries. The UISP application fails to implement parameterized queries or proper escaping mechanisms in multiple code paths, allowing SQL metacharacters to be interpreted as SQL commands rather than data.

When user input containing SQL syntax is processed by the vulnerable application, it is directly concatenated into SQL query strings without proper sanitization. This allows attackers to break out of the intended query context and inject additional SQL commands that execute with the privileges of the database user configured for the UISP application.

Attack Vector

The attack is network-based and requires the attacker to have valid credentials with at least low-level privileges in the UISP application. The exploitation process typically involves:

1. Authentication to the UISP application using valid low-privilege credentials
2. Identifying input fields or API endpoints that are vulnerable to SQL Injection
3. Crafting malicious SQL payloads designed to escalate privileges or extract sensitive data
4. Submitting the crafted input through the vulnerable interface
5. Leveraging the injected SQL to modify user roles, access administrative functions, or exfiltrate data

The vulnerability allows attackers to affect resources beyond the vulnerable component's scope, meaning the impact can extend to other systems that share the same database infrastructure or trust relationships with the UISP application.

Detection Methods for CVE-2025-24290

Indicators of Compromise

• Unusual database queries containing SQL injection patterns such as UNION SELECT, OR 1=1, or comment sequences (--, /**/)
• Unexpected privilege changes for low-level user accounts in the UISP application
• Database logs showing queries accessing system tables or user credential stores
• Authentication anomalies where low-privilege users access administrative functions

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns in requests to UISP
• Monitor UISP application logs for unusual parameter values containing SQL syntax characters
• Deploy database activity monitoring to identify anomalous query patterns or unauthorized data access
• Utilize SentinelOne Singularity to detect post-exploitation activities following successful SQL injection attacks

Monitoring Recommendations

• Enable detailed logging for the UISP application and associated database systems
• Configure alerting for failed login attempts followed by successful privilege escalations
• Monitor network traffic to UISP for requests containing encoded SQL injection payloads
• Review database audit logs for queries accessing sensitive tables outside normal application behavior

How to Mitigate CVE-2025-24290

Immediate Actions Required

• Upgrade UISP application to the latest patched version immediately
• Restrict network access to the UISP application to trusted networks only
• Audit all user accounts and remove unnecessary low-privilege access until patching is complete
• Enable database query logging and monitoring to detect exploitation attempts

Patch Information

Ubiquiti has released a security advisory addressing CVE-2025-24290. Organizations should consult the UI Security Advisory Bulletin 048 for detailed patching instructions and download links for the updated UISP application version that resolves these SQL Injection vulnerabilities.

Workarounds

• Place the UISP application behind a reverse proxy with SQL injection filtering capabilities
• Implement network segmentation to limit access to UISP management interfaces
• Temporarily disable or restrict low-privilege user accounts until patches can be applied
• Configure database-level restrictions to limit the scope of queries executable by the UISP application user

# Example: Restrict network access to UISP management interface using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP