SQL Injection Vulnerability in Bookgy Software by E-commerce Solutions

CVE-2025-40618

What is CVE-2025-40618?

Bookgy, a software solution for e-commerce, is prone to an SQL injection vulnerability that allows attackers to interact with the database via the 'IDRESERVA' parameter in the /bkg_imprimir_comprobante.php script. By crafting specific HTTP requests, an attacker could potentially gain unauthorized access to retrieve, create, update, or delete sensitive database entries, undermining the integrity and confidentiality of the affected systems.

References