PT-2025-21685 · Lambertgroup · Lambertgroup Apollo

Tran Nguyen Bao Khanh · Published 2025-05-16 · Updated 2025-05-16 · CVE-2025-32245

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: LambertGroup Apollo versions through 3.6.3

Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. To mitigate the risk, it is recommended to update systems to a newer version.

Recommendations: For versions through 3.6.3, update to version 3.6.4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive database operations until the update is applied.

Fix

SQL injection

CSRF

Weakness Enumeration

CWE-89

CWE-352

Related Identifiers

CVE-2025-32245

Affected Products

Lambertgroup Apollo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-32245 · Security Note
• https://twitter.com/CveFindCom/status/1923409263554130237 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/featured-posts-scroll/vulnerability/wordpress-featured-posts-scroll-plugin-1-25-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/lbg-audio7_html5_full_width_sticky_pro/vulnerability/wordpress-apollo-3-6-3-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1923434401909833906 · Twitter Post