CVE-2025-0668 is a critical flaw (CVSS 9.8) in BOINC Server before 1.4.5. The researcher advisory describes multiple SQL injections. Upgrade to 1.4.5 or later, then review account authenticators and server logs.
What's affected
- Product: BOINC Server, the server side of the BOINC volunteer computing platform.
- Vulnerable: all versions before 1.4.5, per the Compass Security advisory.
- Not vulnerable: versions 1.4.5 and later, per the same advisory.
- Weakness in the record: CWE-89, SQL injection.
- CISA KEV: not listed.
One thing to know when you read the NVD entry. Its text calls the issue stored cross site scripting, while the assigned weakness and the researcher advisory both describe SQL injection. The advisory is titled "BOINC Multiple SQL Injections" and lists this CVE. Treat it as an SQL injection problem and check the advisory for the details.
The advisory describes three separate injection points in different server pages. It notes that the first one was fixed on 19 December 2024. It says the issues are reachable without logging in, and that a successful attack can expose a user's authenticator key, which works as a login token for that user. The CVSS vector agrees: network, no privileges, no user interaction.
How to check if you're exposed
- Find out whether you operate a BOINC project server. If you only run the BOINC client to donate computing time, this CVE is about the server, not your client.
- Check the server version your project runs against the advisory's cutoff of 1.4.5.
- Review web server access logs for unusual requests to the pages named in the advisory, and look for database error messages in logs around the same times.
- Look for logins from unfamiliar addresses on accounts, especially admin accounts, since the advisory says a leaked authenticator allows impersonation.
What to do now
- Upgrade BOINC Server to 1.4.5 or later. Confirm the exact release notes for your deployment before you roll it out.
- Restrict the database account used by the web tier so it can only touch what the project needs.
- If you suspect probing, reset the authenticator keys for affected users and for admins.
- Put a web application firewall rule or an allow list in front of administrative pages while you patch.
- Ask users with elevated rights to change passwords after you rotate keys.
Why it matters
SQL injection, CWE-89, is old and well understood, and it keeps appearing because applications still build queries from request data. When a parameter, a cookie or a form field reaches a database query unchecked, the query can be made to reveal data it was never meant to return.
Here the data at risk is the authenticator key, a secret that stands in for a password. Anyone who learns it can act as that user. For a project with volunteers and admins, that means account takeover without ever guessing a password. The fix is the usual one: bound parameters for every query, and validation of expected types.
The record does not say this is exploited in the wild, and it is not in CISA KEV. The advisory credits a managed bug bounty program for the report. The code used to demonstrate the flaw is in the public advisory, and this post does not repeat it.
Quick check
Does CVE-2025-0668 affect the BOINC desktop client?
The advisory is about BOINC Server. It says nothing about the client. Check the advisory and the BOINC release notes if you are unsure.
What version fixes it?
The Compass Security advisory lists versions 1.4.5 and later as not vulnerable. Confirm against the project's release notes for your branch.
Sources
Last reviewed: 19 October 2026.
