CVE-2025-26852CWE-89

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection

Critical · published March 20, 2025

CVSS v3.1
10.0
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

🚨 SQL injection is lurking in DESCOR INFOCAD 3.5.1 and earlier! An attacker could pop in crafted SQL queries with devastating ease. 🔥 Think of it like a sneaky chef who can slip extra ingredients into your order without anyone noticing. If the kitchen isn’t checking the orders closely, there's no telling what they might end up serving! This vulnerability allows an attacker to manipulate the database directly, which means they could steal sensitive information, alter your data, or even wipe everything clean. The consequences could be absolutely devastating for any organization relying on this software!

Put simply

Think of it like a sneaky chef who can slip extra ingredients into your order without anyone noticing. If the kitchen isn’t checking the orders closely, there's no telling what they might end up serving! This SQL Injection vulnerability in DESCOR INFOCAD allows attackers to insert arbitrary SQL commands via user input, compromising the integrity and confidentiality of your database.

What to do

This vulnerability allows an attacker to manipulate the database directly, which means they could steal sensitive information, alter your data, or even wipe everything clean. The consequences could be absolutely devastating for any organization relying on this software! Upgrade DESCOR INFOCAD to version 3.5.2.0 immediately to patch this vulnerability. Additionally, implement input validation and prepared statements to secure your database against further attacks. You've got this! By taking action now, you can secure your systems and stay ahead. 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00409 · 34.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-03-20T00:00Z
EPSS history
Timeline
  • 20 MAR 00:00Z
    DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection
    cvelistv5