PT-2025-10441

CVE-2025-2113

Publicado

2025-03-09

Atualizado

2025-03-14

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AT Software Solutions ATSVD versions up to 3.4.1

Description A critical issue affects some unknown functionality of the component Esqueceu a senha. The manipulation of the txtCPF argument leads to SQL injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations Upgrading to version 3.4.2 is able to address this issue. It is recommended to upgrade the affected component. As a temporary workaround, consider restricting the use of the txtCPF argument to minimize the risk of exploitation.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Y4G0

Yago Martins

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')