SQL Injection in Customer Support System by an Unknown Vendor

CVE-2025-40728

What is CVE-2025-40728?

An SQL injection vulnerability exists in the Customer Support System v1.0, where authenticated attackers can manipulate the system by exploiting the id parameter in the /customer_support/manage_user.php endpoint. This allows attackers to gain unauthorized access, enabling them to retrieve, create, update, and delete sensitive database information, thereby compromising the integrity and confidentiality of the data managed by the application.

References