CVE-2025-56401 Details
Description
ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName.
A SQL injection vulnerability has been identified in ZIRA Group WBRM version 7.0, specifically within the 'referenceLookupsByTableNameAndColumnName' function. This vulnerability allows authenticated, low-privileged attackers to execute arbitrary SQL queries on the application's backend database. The issue arises because the 'tableName' and 'columnName' parameters are not properly validated or parameterized, enabling injection of malicious SQL that could be exploited to access, modify, or delete database records. In some cases, this could lead to privilege escalation and administrative access.
To address this vulnerability, it is recommended to implement prepared statements or parameterized queries, validate and sanitize all user input, and apply the principle of least privilege to database accounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://mstreet97.github.io/security/cve/sqli/2025/07/25/Zira-WBRM-SQL-Injection-CVE-2025-56401.html | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| ziragroup wbrm | 7.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 30, 2025 | Initial Analysis | [email protected] |
| Nov 24, 2025 | CVE Modified | CISA-ADP |
| Nov 24, 2025 | New CVE Received | [email protected] |