SQL injection vulnerability in AES Multimedia's Gestnet
Posted date 26/05/2025
Identificador
INCIBE-2025-0264
Importance
5 - Critical
Affected Resources
Gestnet, version 1.07.
Description
INCIBE has coordinated the publication of a vulnerability of critical severity affecting AES Multimedia's Gestnet, a business management software. The vulnerability was discovered by Guzmán Fernández.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and vulnerability type CWE:
- CVE-2025-40671: CVSS v4.0: 9.3 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-93
Solution
There is no reported solution at this time.
Detail
CVE-2025-40671: SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘fk_remoto_central’ parameter on the ‘/webservices/articles.php’ endpoint.
References list
Etiquetas
