CVE-2025-0063: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

CVE-2025-0063 is a high-severity SQL injection vulnerability affecting SAP NetWeaver AS ABAP and ABAP Platform, discovered and disclosed on January 13, 2025. The vulnerability exists because the system does not check for authorization when a user executes some RFC function modules (NVD, SecurityWeek).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-89 (SQL Injection) and allows an attacker with basic user privileges to perform SQL injection attacks against the Informix database (NVD, SecurityOnline).

The successful exploitation of this vulnerability could lead to a complete compromise of confidentiality, integrity, and availability of the affected system. An attacker with basic user privileges could gain control over the data in the Informix database (NVD).

SAP has released security patches to address this vulnerability as part of its January 2025 Security Patch Day. Organizations are strongly advised to apply the available patches as soon as possible (SecurityWeek).