External risk intelligence

CentralSquare Community Development SQL Injection Vulnerability in permit_no Field.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-64280

CentralSquare Community Development is often deployed as a public-facing portal for citizens to access municipal services, permit applications, and tracking. Such web-based portals are intended to be accessible over the internet for public use, making the application's interface and its associated fields commonly reachable in typical deployments.

SQL Injection

Centralsquare Community Development

19.5.7

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in CentralSquare's Community Development software that could allow unauthorized access to sensitive information and system control. This issue stems from how the software handles specific input fields, potentially enabling malicious actors to execute commands on the underlying database. The main concern is confirming if our organization utilizes this specific software and version, and if so, understanding the potential exposure.

Flaw lets attackers run commands through specific software input.
Matters if we use this software for public-facing services.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted SQL commands through the `permit_no` field in the Community Development application. This could allow them to manipulate the database, potentially leading to unauthorized access or modification of sensitive information.

Accessible via the network.
User input in `permit_no` field.
Database compromise.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the `permit_no` field of CentralSquare Community Development could allow an attacker to run arbitrary SQL commands. This could potentially affect system data integrity and availability, as well as expose sensitive information when supported by the advisory.

System data and service behavior.
SQL commands injected via the network.
Unauthorized access and data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The potential for SQL injection in CentralSquare Community Development points to application owners and potentially infrastructure or platform teams as key stakeholders. The immediate priority is to locate instances of the affected software, determine if they are exposed to the internet or handle critical data, and then identify the specific business or technical owner responsible for that instance. Remediation planning should then proceed based on the assessed risk and ownership.

Application owners should manage remediation efforts.
Verify external exposure and business criticality first.
Plan maintenance and coordinate with CentralSquare.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CentralSquare Community Development?

CentralSquare Community Development is a software suite frequently used by local governments and municipalities. It powers public-facing portals that allow citizens to apply for permits, track applications, and interact with various municipal services online.

What is the CWE-89 weakness associated with CVE-2025-64280?

This vulnerability is a SQL Injection, classified as CWE-89. In plain terms, it means the application fails to properly sanitize user input, allowing an attacker to insert their own database commands. By providing malicious input into the vulnerable field, an attacker could trick the system into executing unauthorized actions against the underlying database.

How does an attacker trigger this SQL injection?

An attacker triggers this vulnerability by inputting crafted SQL commands into the 'permit_no' field within the application. It is important to note that simply visiting the site or performing standard navigation does not trigger the flaw; the bug specifically requires the injection of malicious data into that identified input field to execute.

Is my organization at risk from this vulnerability?

According to Halo Surface Signal, this software is often deployed as a public-facing portal to facilitate citizen services, which frequently makes it accessible over the internet. Organizations running the affected version are at higher risk if their instance is reachable by the public, as this network accessibility allows an attacker to attempt the injection remotely without needing internal network access.

What steps should I take if we use this software?

First, confirm if your organization is running version 19.5.7 of Community Development. If confirmed, identify the business or technical owner of that instance to assess its public exposure and data criticality. Once you have located the affected assets, coordinate with your team to plan the necessary maintenance or security updates provided by CentralSquare.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.