CVE-2025-58112 - Vulnerability Analysis

Overview

Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) contains a SQL injection caused by processing malicious .rdl files in SQL Server Reporting Service, letting attackers with Add Reporting Services Reports privilege execute arbitrary SQL commands, exploit requires report generation privilege or preloaded malicious report.

Severity & Score

Impact

Attackers can execute arbitrary SQL commands and potentially OS commands, leading to full database and system compromise.

Mitigation

Update to the latest available version with security patches.

References

• https://gist.github.com/Redteam-LongwaveSpa/141f6c52ce49f9c0f49989c7d6940abd
• https://microsoft.com

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner