External risk intelligence

AKCE SKSPro SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-8587

A critical SQL injection vulnerability exists in AKCE Software Technology's SKSPro software, potentially allowing attackers to manipulate the database. If reachable, this could lead to unauthorized access, modification, or disclosure of sensitive data, impacting system integrity and confidentiality. Confirmation of SKS

4Halo Surface Signal

SQL Injection

Akceyazilim Skspro

2026-07-01 and earlier

External exposure likelihood

Halo Surface Signal score for CVE-2025-8587

SKSPro is a software product that typically functions as a web-based application. SQL injection vulnerabilities in such applications are commonly reachable via the internet if the application is deployed as a public-facing web service or portal, which is a standard deployment pattern for this class of software.

PCI scan relevance

PCI Relevance for CVE-2025-8587

Yes

CVE-2025-8587 — Halo PCI Relevance: Yes. Under typical PCI ASV external scan criteria, this issue may be flagged for scan prioritization.

This SQL injection vulnerability affects applications and is relevant to PCI DSS Requirement 6.5.1, which mandates protection against injection flaws. Exploitation could allow unauthorized access to or modification of sensitive data.

Scan-prioritization guidance only—not a PCI DSS certification or ASV attestation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in AKCE Software Technology's SKSPro, a type of software that could be widely used. This issue, classified as SQL injection, allows for unauthorized manipulation of the underlying database, which at a high level could expose sensitive information or disrupt operations. The primary concern is to determine if our organization utilizes this specific software and, if so, to assess the potential exposure and relevance to our environment.

  • Allows database manipulation through code injection.
  • Matters for protecting sensitive data and systems.
  • Confirm if this software is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to the SKSPro application over the network. Since no authentication or user interaction is required, an attacker can directly target the application's SQL command processing, potentially leading to unauthorized access or modification of sensitive data.

  • No authentication or user interaction needed.
  • Vulnerable SQL command processing.
  • Complete compromise of data integrity.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database when supported by the advisory. This may result in the disclosure of sensitive system data or user information.

  • Unauthorized database access.
  • Remote code execution via SQL commands.
  • Sensitive data disclosure or corruption.

Priority actions

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in SKSPro likely requires action from application owners and potentially platform or infrastructure teams, depending on deployment. The first practical step is to identify all instances of SKSPro, determine their reachability and business criticality, and then assign an accountable owner to manage the remediation effort.

  • Application owners should manage remediation.
  • Verify SKSPro instances and exposure.
  • Plan risk-based remediation actions.

Frequently asked questions

What is AKCE SKSPro and what is it used for?

AKCE SKSPro is a software product developed by AKCE Software Technology R&D Industry and Trade Inc. While the specific use case isn't detailed, it's described as a software that allows for database manipulation through code injection, suggesting it might be used for data management or as part of a larger application that interacts with a database.

How does CVE-2025-8587 impact AKCE SKSPro?

CVE-2025-8587 is a critical vulnerability classified as SQL Injection (CWE-89). This means that an attacker can insert malicious SQL code into input fields, which the SKSPro application might then execute on its database. This could lead to unauthorized access, modification, or deletion of data.

What actions are needed to trigger the CVE-2025-8587 vulnerability?

The vulnerability in SKSPro can be exploited by an attacker sending specially crafted data over the network to the application. The advisory indicates that no authentication or user interaction is required, meaning an attacker could potentially exploit this by simply interacting with the application's interface or endpoints.

Who should be concerned about this CVE-2025-8587 threat?

Organizations that use AKCE SKSPro should be concerned. Halo Surface Signal indicates this vulnerability is likely external-facing, meaning it could be accessible from the internet. This suggests a higher risk for applications deployed as public-facing web services or portals.

What are the first steps for responding to this SKSPro vulnerability?

The first practical steps involve identifying all instances of SKSPro within your environment. Once identified, determine how these instances are accessed (e.g., internet-facing or internal) and their importance to your operations. Assigning an accountable owner to manage the subsequent remediation efforts is also a key initial action.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished Modified