Critical · published October 2, 2025
🚨 Just one rogue POST request could give an attacker full control over your databases in AndSoft's e-TMS! 🔥 Think of it like a restaurant where the chef is asked to follow an order without checking the recipe — one incorrect request could lead to a complete menu overhaul, allowing anything from new dishes to clearing the entire stock! In the worst-case scenario, an attacker could not only read sensitive information but also create, modify, or even wipe entire databases. This is an absolute nightmare for data integrity and security, leaving your systems vulnerable to exploitation. Imagine the havoc that could wreak on your operations!
Think of it like a restaurant where the chef is asked to follow an order without checking the recipe — one incorrect request could lead to a complete menu overhaul, allowing anything from new dishes to clearing the entire stock! This SQL injection vulnerability occurs due to improper validation of the 'USRMAIL' parameter in the '/inc/login/TRACK_REQUESTFRMSQL.ASP' file, allowing malicious SQL commands to be executed by submitting crafted requests.
In the worst-case scenario, an attacker could not only read sensitive information but also create, modify, or even wipe entire databases. This is an absolute nightmare for data integrity and security, leaving your systems vulnerable to exploitation. Imagine the havoc that could wreak on your operations! To protect your systems, immediately patch to the latest version of AndSoft's e-TMS. Implement parameterized queries to improve input validation and consider conducting a security audit of your database interactions to identify any additional weak points. You've got this! With these steps, you'll shore up your defenses and keep your databases safe from unwanted intruders. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| andsoft/e-tms | all versions | — |