CVE-2025-3957 is a medium severity SQL injection flaw (CVSS 6.3) in springboot-admin 1.0 from opplus. Input reaches a database query unsafely through the order argument handled in the mapper file src/main/resources/mapper/sys/SysLogDao.xml. The record says the exploit is public and lists no fixed version, so restrict access now and fix the query code yourself.
What's affected
The record names one product and one version: springboot-admin 1.0. The weak spot is the order argument handled in the mapper file src/main/resources/mapper/sys/SysLogDao.xml.
The CVSS vector says the attack runs over the network, with low complexity, a low privilege account and no user interaction. In plain terms, an attacker needs a low privilege account first, which is easy to get on many small deployments.
The record states that the exploit has been disclosed to the public and may be used. It does not name a fixed release. I could not confirm a patched version from the sources listed in the record, so check the vendor site for an update before you assume one exists.
How to check if you're exposed
This is a source code application, so there is no package manager version to query. Start with where it is deployed and how it is reached.
- Find the deployment. Search your repositories and servers for the project name and for the mapper file named above.
- Confirm the version or commit. The record covers 1.0.
- Open the mapper file and look at how the sort or order value is built. Values placed straight into the query text, instead of being checked against a fixed list of allowed column names, are the problem.
- Check web server logs for requests to the matching endpoint with unusual sort values, and for database errors around the same time.
grep -rn "order" src/main/resources/mapper/sys/SysLogDao.xml
If you run many small web apps and are not sure which ones are internet facing, an external DAST scan of your own sites will list them. Our free in-browser dependency scan covers the libraries a project ships, which is a useful second check, but it will not find a flaw in an application's own code like this one.
What to do now
- Take the application off the public internet, or put it behind a VPN, an allow list or single sign on, until the code is fixed.
- Change the query so the sort field is chosen from a short fixed list of column names in code, and the direction is limited to ascending or descending. Never pass the raw request value into the query text.
- Run the database account the application uses with the minimum rights it needs. It should not own the schema or hold file or administrative privileges.
- Check the vendor or project page for a newer release and read its notes before upgrading. If none exists, plan to replace the application or maintain your own patched copy.
- Review logs from before your change for odd requests and database errors, and rotate any credentials stored in the application database if you see signs of abuse.
A web application firewall rule can reduce noise while you work, but it does not fix the query. Treat it as a stopgap only.
Why it matters
The weaknesses are SQL injection (CWE-89) and its parent, improper neutralization of special elements in output used by a downstream component (CWE-74). A value from the user becomes part of the database command, so the person sending it can change what the command does.
This is an admin style Java project, where a log or listing page is a common place for a sort value to slip into a query. With a low privilege account, the record rates confidentiality, integrity and availability impact as low each, which is why the score sits at 6.3 rather than higher. Small scores still matter when the data behind them is personal.
This CVE is not on the CISA Known Exploited Vulnerabilities list. That is not a reason to wait, because the record says exploit details are public.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version I can install?
No. The record lists springboot-admin 1.0 as affected and names no fixed release. Check the vendor site, and until you find one, fix the query in your own copy and restrict access.
Is a web application firewall enough?
Not by itself. It can slow down obvious attempts, but the unsafe query is still there. Use prepared statements and treat the filter as a stopgap.
Sources
The CVE record also lists third party write-ups and a VulDB entry. They are not vendor advisories, and this post does not reproduce any exploit detail from them.
Last reviewed: 18 October 2026.
