CVE-2025-65950 is a high-severity SQL Injection vulnerability (CWE-89) affecting WBCE CMS versions prior to 1.6.5. The vulnerability resides in the admin/users/save.php script, which processes user profile updates. Specifically, the groups[] parameter from the user edit form is improperly sanitized, allowing a low-privileged authenticated user with user modification permissions to inject arbitrary SQL commands. This improper neutralization of special SQL elements enables attackers to manipulate backend database queries, potentially leading to full database compromise. The attacker can exfiltrate sensitive data, modify or delete records, and bypass all security controls enforced by the CMS. The vulnerability does not require elevated privileges beyond the ability to modify users, no user interaction beyond authentication, and has a low attack complexity. The CVSS 4.0 score is 9.4 (critical), reflecting the high impact on confidentiality, integrity, and availability, combined with ease of exploitation. Although no known exploits are currently in the wild, the vulnerability’s nature makes it a prime target once publicized. The issue is resolved in WBCE CMS version 1.6.5, which properly sanitizes the groups[] parameter to prevent SQL injection. Organizations running vulnerable versions should prioritize upgrading to the patched release to eliminate this critical risk.

For European organizations using WBCE CMS versions 1.6.4 or earlier, this vulnerability poses a severe risk. Exploitation can lead to full database compromise, resulting in unauthorized disclosure of sensitive personal data, intellectual property, or business-critical information. This undermines confidentiality and can cause regulatory non-compliance, especially under GDPR. Integrity of data is at risk as attackers can alter or delete records, potentially disrupting business operations or corrupting audit trails. Availability may also be affected if attackers delete or lock database content. The ability for low-privileged users to escalate privileges and bypass security controls increases insider threat risks and complicates detection. Given the criticality, organizations face potential reputational damage, financial loss, and legal consequences. The threat is particularly acute for sectors relying on WBCE CMS for public-facing websites or internal portals containing sensitive data.

1. Immediate upgrade of WBCE CMS installations to version 1.6.5 or later, which contains the fix for this vulnerability. 2. Restrict user modification permissions strictly to trusted administrators; review and minimize the number of users with such privileges. 3. Implement Web Application Firewalls (WAFs) with custom rules to detect and block suspicious SQL injection payloads targeting the groups[] parameter. 4. Conduct thorough audits of user accounts and permissions to identify and remediate any excessive privileges. 5. Monitor database logs and CMS activity logs for unusual queries or user modification activities indicative of exploitation attempts. 6. Employ database-level access controls and segmentation to limit the impact of any successful injection. 7. Regularly back up databases and test restoration procedures to ensure recovery capability in case of data corruption or deletion. 8. Educate administrators about the risks of SQL injection and the importance of applying security patches promptly.