CVE-2025-1641

Name of the Vulnerable Software and Affected Versions Benner ModernaNet versions 1.1.0 and earlier

Description A critical issue has been found in Benner ModernaNet, affecting an unknown part of the file /AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&localatend=1&idplano=5&pesfis=01&idprofissional=0&target=.horarios--dia--d0& =1739371223797. The manipulation leads to SQL injection, and it is possible to initiate the attack remotely. Upgrading to version 1.1.1 can address this issue.

Recommendations To resolve the issue, upgrade to version 1.1.1. As a temporary workaround, consider restricting access to the vulnerable API endpoint /AGE0000700/GetHorariosDoDia until the update is applied. Avoid using the parameters idespec, idproced, data, agserv, convenio, localatend, idplano, pesfis, idprofissional, and target in the affected API endpoint until the issue is resolved.