N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62228

CVE-2025-62228: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0 which address this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62228

CVE-2025-62228:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.flink:flink-cdc-pipeline-connectors	maven	>= 3.0.0, < 3.5.0	3.5.0
org.apache.flink:flink-connector-oracle-cdc	maven	>= 3.0.0, < 3.5.0	3.5.0
org.apache.flink:flink-connector-db2-cdc	maven	>= 3.0.0, < 3.5.0	3.5.0
org.apache.flink:flink-connector-sqlserver-cdc	maven	>= 3.0.0, < 3.5.0	3.5.0
org.apache.flink:flink-connector-mysql-cdc	maven	>= 3.0.0, < 3.5.0	3.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper construction of SQL queries using un-sanitized user-provided identifiers such as database and table names. This allows for SQL injection attacks. The analysis of the provided patch (commit d5766187a9a4b191820e10238d4594ae665cdb89) shows that multiple methods in the org.apache.flink.cdc.connectors.oceanbase.catalog.OceanBaseMySQLCatalog class were vulnerable.

The vulnerable functions were using String.format to build SQL queries, embedding raw database and table names into the query string. This is a classic SQL injection vector. An attacker could provide a specially crafted identifier (e.g., mydb' OR '1'='1) to manipulate the query's logic or inject entirely new SQL commands.

The patch addresses these issues in two ways:

For data query language (DQL) statements (e.g., SELECT), the code was refactored to use PreparedStatement with parameter markers (?). This is the standard and recommended way to prevent SQL injection.
For data definition language (DDL) statements (e.g., CREATE TABLE, DROP TABLE), where parameter markers often cannot be used for identifiers, a new quote function was introduced. This function properly escapes the identifiers by wrapping them in backticks and escaping any existing backticks within the identifier itself, which is the correct way to handle identifiers in MySQL-compatible databases like OceanBase.

While the vulnerability advisory mentions several Flink CDC connectors (Oracle, DB2, SQL Server, MySQL), the provided patch only contains fixes for the oceanbase connector. It is highly likely that similar vulnerable code patterns exist in the other connectors, and security engineers should investigate those as well, even though this specific commit does not patch them.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.