Multiple vulnerabilities in Summar Software Employee Portal
Posted date 18/09/2025
Identificador
INCIBE-2025-0505
Importance
4 - High
Affected Resources
Portal del Empleado, versions prior to 3.98.0.
Description
INCIBE has coordinated the publication of two vulnerabilities: one high severity and one medium severity, affecting Summar Software´s Portal del Empleado. The vulnerabilities were discovered by Pedro Gabaldón Juliá, Javier Medina Munuera, Antonio José Gálvez Sánchez, Alejandro Baño Andrés, and Álvaro Piñero Laorden.
These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector and CWE vulnerability type for each vulnerability:
- CVE-2025-40677: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-89
- CVE-2025-40678: CVSS v4.0: 5.3 | CVSS AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-434
Solution
The vulnerabilities have been fixed by the Summar Software team in version 3.98.0.
Detail
- CVE-2025-40677: SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.
- CVE-2025-40678: unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerous file type by sending a POST request using the parameter “cctl00$ContentPlaceHolder1$fuAdjunto” in “/MemberPages/ntf_absentismo.aspx”.
CVE
Explotación
No
References list
Etiquetas
