SQL Injection Vulnerability in Bookgy Software by E-commerce Solutions
CVE-2025-40618

9.3CRITICAL

Key Information:

Vendor

Bookgy

Status
Bookgy
Vendor
CVE Published:
29 April 2025

What is CVE-2025-40618?

Bookgy, a software solution for e-commerce, is prone to an SQL injection vulnerability that allows attackers to interact with the database via the 'IDRESERVA' parameter in the /bkg_imprimir_comprobante.php script. By crafting specific HTTP requests, an attacker could potentially gain unauthorized access to retrieve, create, update, or delete sensitive database entries, undermining the integrity and confidentiality of the affected systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Bookgy all versions

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David UtĂłn Amaya (m3n0sd0n4ld)
JSON
.