Multiple vulnerabilities in Customer Support System
Posted date 16/06/2025
Identificador
INCIBE-2025-0321
Importance
4 - High
Affected Resources
Customer Support System.
Description
INCIBE has coordinated the publication of 2 vulnerabilities: 1 of high severity and 1 of medium severity, affecting Customer Support System, a simple project that helps companies that offer technical support after the purchase of a product. The vulnerabilities have been discovered by Rafael Pedrero.
These vulnerabilities have been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2025-40728: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-89
- CVE-2025-40729: CVSS v4.0: 4.8 | CVSS AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CWE-79
Solution
There is no reported solution at this time.
Detail
- CVE-2025-40728: SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databases via the id parameter in the /customer_support/manage_user.php endpoint.
- CVE-2025-40729: reflected Cross-Site Scripting (XSS) vulnerability in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter.
References list
Etiquetas
