CVE-2025-56556: Subrion CMS 4.2.1 Escalation of Privileges via SQL Tool
Summary
CVE-2025-56556: Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool. Affects intelliants/subrion versions < 4.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subrion is an open-source content management system (CMS) that allows users to create and manage websites easily. It features a user-friendly interface, customizable templates, and various plugins to enhance functionality. However, a vulnerability in version 4.2.1 allows authenticated administrators or moderators to exploit the built-in Run SQL Query feature, leading to escalated privileges.
Vulnerability Detail
The vulnerability arises from inadequate access controls in the SQL Tool admin panel of Subrion CMS. Authenticated users with access to this feature can execute arbitrary SQL queries, potentially allowing them to manipulate the database and gain unauthorized access to sensitive information or escalate their privileges within the application. This issue is classified under CWE-566, indicating a lack of proper access control mechanisms.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the SQL Tool admin panel to only trusted administrators. Additionally, consider disabling the Run SQL Query feature until the package is updated to mitigate potential exploitation.
Conclusion
The vulnerability CVE-2025-56556 in Subrion CMS 4.2.1 poses a significant risk by allowing privilege escalation through the SQL Tool. It is crucial to update to the patched version or implement workarounds to safeguard your application.
See every vulnerability recorded for intelliants/subrion →
FAQ
CVE-2025-56556 is a vulnerability in Subrion CMS 4.2.1 that allows authenticated users to escalate privileges through the SQL Tool.
If you are using Subrion CMS version 4.2.1, your installation is vulnerable. You can check your version in the admin panel or by inspecting the composer.lock file.
If an immediate update is not possible, restrict access to the SQL Tool and disable the Run SQL Query feature as a temporary measure.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data, manipulation of the database, and overall compromise of the application security.
Vulert monitors open-source vulnerabilities in your software using the composer.lock file, providing real-time alerts without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for intelliants/subrion.
