CVE-2025-40666

Name of the Vulnerable Software and Affected Versions TCMAN's GIM version 11

Description Time-based blind SQL injection vulnerabilities in TCMAN's GIM allow an attacker to retrieve, create, update, and delete databases through the ArbolID parameter in "/GIMWeb/PC/frmPreventivosList.aspx".

Recommendations For TCMAN's GIM version 11, consider disabling the ArbolID parameter in the "/GIMWeb/PC/frmPreventivosList.aspx" endpoint as a temporary workaround until a patch is available. Restrict access to the "/GIMWeb/PC/frmPreventivosList.aspx" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.