CVE-2025-58462: SQL Injection in FOIAXpress PAL

The SQL Injection vulnerability in FOIAXpress PAL poses a significant risk to organizations utilizing this software. An attacker exploiting this flaw can bypass authentication and directly interact with the database. This allows for unauthorized access to sensitive data, including personally identifiable information (PII), confidential documents, and system configuration details. The attacker could also modify or delete data, leading to data loss and disruption of services. The lack of authentication requirements amplifies the risk, as any external user can attempt exploitation. Successful exploitation could result in a complete compromise of the system and its data, similar to scenarios where database credentials are leaked or improperly configured.

1. Reserved2025-09-02
2. Published2025-09-09
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-58462 is to immediately upgrade FOIAXpress PAL to version 11.13.1.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the SearchPopularDocs.aspx endpoint using a Web Application Firewall (WAF) or proxy server, implementing strict input validation rules to filter out potentially malicious SQL queries. Regularly review database access logs for suspicious activity and implement strong database security practices, including least privilege access controls. Consider implementing a Content Security Policy (CSP) to restrict the resources that the application can load, further limiting the potential impact of a successful SQL injection attack.