External risk intelligence

rAthena PartyBooking SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-58448

rAthena is a game server software. While game servers are network-accessible and often exposed to the internet to allow player connectivity, the specific vulnerability exists within the PartyBooking component. This component is not necessarily a public-facing API or web interface by default, and its exposure depends heavily on the specific configuration and deployment of the game server instance.

SQL Injection

Rathena

before 2025-09-06

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in rAthena, an open-source game server software, which could allow attackers to inject malicious SQL code. This SQL injection flaw, found in the PartyBooking component, poses a significant risk due to its potential for unauthorized data access, modification, or deletion. The primary concern at this time is to confirm whether this specific component is exposed and actively used within our deployed instances.

Remote attackers can execute malicious SQL commands.
Game server integrity and player data may be at risk.
Confirm relevance and exposure of the affected component.

Attack Path

How an attacker could exploit the issue

An attacker could target the rAthena game server because it is accessible over the network. By sending specially crafted data to the PartyBooking component, an attacker could inject malicious SQL code. This could allow them to read, modify, or delete sensitive data on the server, potentially leading to a complete compromise of the game's database.

Network access required.
SQL injection via `WorldName`.
Full data compromise risk.

Live Threat

Current exploitation, exposure, and threat context

The PartyBooking component in rAthena servers, when exposed to the network, is susceptible to SQL injection through the `WorldName` parameter. This vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the server's database.

Game server database.
Unauthenticated network access.
Data corruption or exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The rAthena game server, specifically its PartyBooking component, is vulnerable to SQL injection. Teams responsible for managing game servers, platform operations, and potentially application owners who host these servers should prioritize this vulnerability. The immediate first step is to inventory all rAthena instances, assess their exposure and criticality, and identify the system owner for each instance to coordinate remediation.

Game server and platform teams own this.
Verify PartyBooking component exposure.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is rAthena?

rAthena is an open-source, cross-platform software project designed to emulate a massively multiplayer online role-playing game (MMORPG) server. Community members and developers use it to host and customize their own game worlds, managing player interactions, character data, and game state through its server-side architecture.

How does this SQL injection affect rAthena?

This vulnerability is classified as CWE-89, which means the software fails to properly sanitize user-supplied input before using it in a database query. In CVE-2025-58448, the flaw exists in the PartyBooking component. An attacker can input malicious SQL code into the 'WorldName' parameter to trick the server into running unintended commands, potentially giving them unauthorized access to read, change, or delete database information.

Can any data be sent to trigger this vulnerability?

The issue is triggered specifically when the PartyBooking component processes data through the 'WorldName' parameter. Simply connecting to the game server is not enough; the attacker must provide crafted input that interacts with this specific component. If your server configuration has disabled or does not utilize the PartyBooking feature, this specific attack path is not applicable.

Is my rAthena instance at risk?

According to Halo Surface Signal, risk depends on how your server is deployed. Because rAthena is a game server, it is often accessible over the network to allow players to join. However, the PartyBooking component is not always public-facing. You should check if your specific deployment enables this component and if it is accessible to untrusted network traffic.

What should I do to secure my server?

First, inventory your systems to identify all running rAthena instances. Check if your current version is prior to commit 0d89ae0. If it is, coordinate with your team to update the software to the patched version, which resolves the flaw. Prioritize updates based on the importance of the data stored on each server.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.