Critical · published October 16, 2025
🚨 A single malicious input in the 'cat' parameter of Sergestec's Exito v8.0 can unleash chaos, granting attackers unfettered control over your databases! 🔥 Think of this vulnerability as a waiter who blindly accepts any order without checking what's actually on the menu. An attacker simply needs to specify what they want, and the database serves it up—no questions asked! With full access to create, read, update, or delete databases, an attacker could wreak absolute havoc—exposing sensitive data, altering critical information, or even wiping everything clean! This could lead to devastating data breaches and operational disruption.
Think of this vulnerability as a waiter who blindly accepts any order without checking what's actually on the menu. An attacker simply needs to specify what they want, and the database serves it up—no questions asked! This SQL injection vulnerability allows attackers to manipulate database queries through the 'cat' parameter in '/public.php', bypassing authentication and executing arbitrary SQL commands.
With full access to create, read, update, or delete databases, an attacker could wreak absolute havoc—exposing sensitive data, altering critical information, or even wiping everything clean! This could lead to devastating data breaches and operational disruption. Immediately patch Exito to the latest version to close this vulnerability. Additionally, implement input validation and prepared statements to mitigate SQL injection risks in the future. You've got this! Take these steps, and you'll be back in the driver's seat of your security in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| sergestec/exito | all versions | — |