SQL Injection Vulnerability in DM Corporative CMS by DMACROWEB
CVE-2025-40654

9.3CRITICAL

Key Information:

Vendor

Dmacroweb

Status
Dm Corporative Cms
Vendor
CVE Published:
10 June 2025

What is CVE-2025-40654?

A SQL injection vulnerability exists in DM Corporative CMS, allowing attackers to manipulate SQL queries. By exploiting this flaw, attackers can retrieve, create, update, and delete database entries using the 'name' and 'cod' parameters in the /antbuspre.asp file. This vulnerability poses a significant threat to data integrity and can be leveraged to execute unauthorized commands on the database.

Affected Version(s)

DM Corporative CMS 0 < 2025.01

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Oscar Atienza
.
CVE-2025-40654 : SQL Injection Vulnerability in DM Corporative CMS by DMACROWEB