Critical · published October 2, 2025
🔥 Just one sneaky POST request can let an attacker play puppet master with your entire database! Think of it like a waiter who accidentally hands over the master key to the kitchen instead of just the menu, allowing access to everything from recipes to storage. This SQL injection vulnerability is the unintended permission slip that should never have been issued! If exploited, an attacker could retrieve, create, update, or even delete critical database information, leading to catastrophic data loss or corruption. Imagine your entire operations getting derailed because someone snagged the secret recipe for your most prized dish!
Think of it like a waiter who accidentally hands over the master key to the kitchen instead of just the menu, allowing access to everything from recipes to storage. This SQL injection vulnerability is the unintended permission slip that should never have been issued! This SQL injection vulnerability in AndSoft's e-TMS (version 25.03) allows attackers to manipulate requests via a 'SessionID' cookie in the '/inc/connect/CONNECTION.ASP' endpoint, effectively gaining unauthorized access to your databases.
If exploited, an attacker could retrieve, create, update, or even delete critical database information, leading to catastrophic data loss or corruption. Imagine your entire operations getting derailed because someone snagged the secret recipe for your most prized dish! Immediately patch to the latest version of e-TMS and ensure that all user inputs are properly sanitized before being processed. Implement prepared statements for your SQL queries to mitigate this risk. You've got this! Follow these steps and you'll secure your databases in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| andsoft/e-tms | all versions | — |