SQL Injection Vulnerability in vtenext Affecting User Account Security
CVE-2025-71456
8.6HIGH
Key Information:
Badges
👾 Exploit Exists
What is CVE-2025-71456?
The vtenext product prior to version 25.02.2 is vulnerable to SQL injection due to improper handling of the fieldname parameter in modules/Fax/EditView.php. This flaw permits authenticated low-privileged users to inject malicious SQL queries, potentially allowing attackers to access sensitive database information, such as password reset tokens stored in vte_userauthtoken. By exploiting this vulnerability, attackers could gain unauthorized access to other user accounts, compromising the integrity and security of the affected system.
Affected Version(s)
vtenext 0 < 25.02.2
References
CVSS V4
Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
Mattia "0xbro" Brollo