CVE-2025-56450

Name of the Vulnerable Software and Affected Versions Log2Space Subscriber Management Software version 1.1

Description Log2Space Subscriber Management Software version 1.1 contains a SQL injection flaw. An attacker can send a crafted POST request to the /l2s/api/selfcareLeadHistory endpoint, exploiting the lead id parameter. The backend does not properly sanitize user input, which could allow an attacker to enumerate database schemas and table names, potentially leading to full database compromise.

Recommendations Apply input sanitization and validation to the lead id parameter in the /l2s/api/selfcareLeadHistory endpoint.