CVE-2026-8025: SQLi in MOSK Informatics' CBS Platform

Synopsis

SQL injection in MOSK Information Technologies' CBS Platform allows an unauthenticated remote attacker to interact directly with the underlying database. The vulnerability is reachable over the network, requires no credentials, and no victim interaction. Successful exploitation gives the attacker full read, write, and denial-of-service capability against the database. The vendor has confirmed the product is unsupported, so no patch is forthcoming; HarborGuard tracks the advisory and will make a patched rebuild available if an upstream fix is ever published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from the internet or any routable network path without requiring local or physical access.

• AuthenticationNot required

  No credentials of any privilege level are needed; the attacker can send malicious SQL payloads as an anonymous, unauthenticated user.

• Victim interactionNot required

  No user action is required; the attacker sends crafted requests directly to the service without involving any logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free with no race conditions, memory layout dependencies, or other environmental factors to overcome.

Blast Radius

• Reads all data the database user can access, including stored credentials, session tokens, and any customer or application records.
• Modifies or deletes persisted database rows, enabling data tampering, record destruction, or privilege escalation within the application.
• Crashes or saturates the database service, causing a denial of service for all application functionality that depends on it.
• May execute database-level commands that reach the underlying operating system, depending on database configuration and privilege grants.