PT-2025-16253
CVE-2025-22371
·
Published
2025-04-14
·
Updated
2025-04-21
Description by
CVSS 4.0
9.3
CriticalMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
Name of the Vulnerable Software and Affected Versions:
SicommNet BASEC (SaaS Service) versions prior to the fixed version, which is not specified.
Description:
The issue is related to an SQL Injection vulnerability in the login page of SicommNet BASEC, allowing an unauthenticated remote attacker to bypass authentication and execute arbitrary SQL commands. This vulnerability has been present in the solution at least since December 14, 2021, and likely before that.
Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾