External risk intelligence

Ruisibi RSBI SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-57140

The vulnerability exists in a DatasetService endpoint within a Business Intelligence (BI) platform. BI platforms and their associated data service APIs are commonly deployed as web-based applications intended for data access and reporting, often making them reachable in network environments where external or authorized users interact with web services.

SQL Injection

Ruisitech Ruisibi

4.7

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical security flaw found in the rsbi-pom software, specifically within its data service component. The vulnerability allows for unauthorized manipulation of the system's database through crafted network requests. While the primary concern is confirming if this specific software is in use, the potential for data compromise and system disruption warrants executive awareness.

Flaw allows unauthorized database access.
Critical risk if the affected software is in use.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component through the network without needing any special privileges or user interaction. The vulnerability is located in the DatasetService path of the rsbi-pom software, specifically at the /bi/service/model/DatasetService endpoint. Successful exploitation could lead to a critical compromise of the system.

No special access needed.
SQL injection in DatasetService path.
Full system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the DatasetService path of the rsbi-pom business intelligence platform could allow an unauthenticated attacker to inject malicious SQL code. When successfully exploited, this could lead to unauthorized access, modification, or deletion of the underlying database, potentially affecting sensitive business data.

Business intelligence data could be exposed.
Malicious SQL could be injected over the network.
Unauthorized data access or modification may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the DatasetService path of rsbi-pom requires immediate attention, likely involving application owners and platform teams. The first practical step is to identify all instances of rsbi-pom, determine their network exposure and business criticality, and then pinpoint the accountable owners for each instance to plan remediation.

Application owners should manage the issue.
Verify rsbi-pom deployment reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ruisibi software affected by CVE-2025-57140?

Ruisibi (rsbi-pom) is a business intelligence platform used for data analysis, reporting, and visualization. Organizations deploy it as a web-based application to manage and query large datasets through its internal service components.

How does this SQL Injection vulnerability work?

This flaw is a CWE-89 weakness, meaning the application fails to properly sanitize user-provided data before using it in database queries. In this CVE, an attacker sends malicious SQL commands to the DatasetService path, tricking the backend database into executing unauthorized instructions, such as viewing, altering, or deleting data.

Do I need special access to trigger this bug?

No. The vulnerability does not require authentication or user interaction. An attacker only needs network access to reach the /bi/service/model/DatasetService endpoint. Simply sending a crafted request to this path is enough to trigger the flaw; it is not dependent on a specific user session or administrative login.

Why is this CVE considered an external risk?

According to Halo Surface Signal, this software is typically deployed as a web service for data reporting, often making these API endpoints reachable from broader network environments. Because the service can be exposed to external or authorized network users, the potential for unauthorized access to business data is significant.

When should I begin addressing this issue?

You should prioritize this immediately by first identifying where Ruisibi is running in your environment. Once you have a complete inventory, verify the network reachability of those instances and confirm which business functions rely on them. Engaging your application owners early ensures you can effectively plan for updates or mitigating configurations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.