SQL Injection Vulnerability in Bookgy by INCIBE

CVE-2025-40617

What is CVE-2025-40617?

An SQL injection vulnerability exists in the Bookgy application, which permits attackers to manipulate the database via crafted HTTP requests. By exploiting parameters such as "IDTIPO", "IDPISTA", and "IDSOCIO" in the /bkg_seleccionar_hora_ajax.php endpoint, unauthorized users can retrieve, create, update, or delete database entries. This vulnerability poses significant risks to data integrity and should be addressed promptly.

References