CVE-2025-22371CWE-89

SQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC

Critical · published April 14, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that.

The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time)

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:Y/V:C
EPSS
0.00601 · 48.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-04-14T15:32Z
EPSS history
Timeline
  • 14 APR 15:32Z
    SQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC
    cvelistv5