VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 19, 2025· Updated Sep 19, 2025

MapServer - WFS XML Filter Query SQL injection

CVE-2025-59431

Description

MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • MapServer/Mapserverllm-fuzzy2 versions
    <8.4.1+ 1 more
    • (no CPE)range: <8.4.1
    • (no CPE)range: < 8.4.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.