PT-2025-11446 · Unknown · Vam Virtual Airlines Manager

Davimo · Published 2025-03-16 · Updated 2025-03-22 · CVE-2025-2353

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: VAM Virtual Airlines Manager versions up to 2.6.2

Description: A critical issue was found in the HTTP GET Parameter Handler of VAM Virtual Airlines Manager, affecting an unknown function of the file /vam/index.php. The manipulation of the ID, registry id, or plane icao arguments leads to SQL injection. This issue can be exploited remotely. Other parameters might also be affected.

Recommendations: For versions up to 2.6.2, consider disabling the index.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the ID, registry id, and plane icao parameters in the affected HTTP GET requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-2353

Affected Products

Vam Virtual Airlines Manager

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-2353 · Security Note
• https://t.me/cvedetector/20424 · Telegram Post
• https://t.me/latest_high_impact_cve/1977 · Telegram Post
• https://twitter.com/vulns_space/status/1901429016298508677 · Twitter Post
• https://vuldb.com/?id.299820 · Note
• https://twitter.com/CVEnew/status/1901420775300538764 · Twitter Post
• https://twitter.com/CVETracker/status/1901725411912114244 · Twitter Post
• https://vuldb.com/?submit.513284 · Note
• https://t.me/cvenotify/114971 · Telegram Post
• https://vuldb.com/?ctiid.299820 · Note
• https://twitter.com/cracbot/status/1903401346709238044 · Twitter Post
• https://t.me/cvetracker/19241 · Telegram Post