PT-2025-12370 · Centralsquare · Etrakit.Net

Publicado 2025-03-20 · Atualizado 2025-03-21 · CVE-2025-29980

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eTRAKiT.Net version 3.2.1.77

Description A SQL injection issue has been discovered due to improper input validation, allowing a remote unauthenticated attacker to run arbitrary commands as the current MS SQL server account.

Recommendations For eTRAKiT.Net version 3.2.1.77, it is recommended that the CRM feature is turned off. Users are recommended to migrate to the latest version of CentralSquare Community Development, as eTRAKiT.Net is no longer supported.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-29980

Produtos afetados

Etrakit.Net

Referências · 10

• https://github.com/cisagov/CSAF/pull/182/files#diff-53861466371a59578b21f5e4b4b6be7b2a6267c5d0fe81eda2a849bf6915ed8d · Correção
• https://github.com/cisagov/CSAF · Nota
• https://twitter.com/VulmonFeeds/status/1903144697285185943 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-29980 · Nota de Segurança
• https://t.me/cvetracker/19572 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-29980 · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/2014 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1902806779932639438 · Publicação no Twitter
• https://t.me/cvedetector/20759 · Publicação no Telegram
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-079-01.json · Nota