PT-2025-22648 · Megabip · Megabip

Kamil Szczurowski + 1 · Published 2025-05-23 · Updated 2025-05-23 · CVE-2025-3893

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MegaBIP versions prior to 5.20

Description The issue arises when a user with high privileges is prompted to provide a reasoning for editing pages managed by MegaBIP. The input provided by the user is not sanitized, leading to a SQL Injection vulnerability.

Recommendations For versions prior to 5.20, update to version 5.20 to fix this issue. As a temporary workaround, consider restricting the input provided by high-privilege users to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-3893

Affected Products

Megabip

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-3893 · Security Note
• https://megabip.pl/index.php?id=24,145 · Vendor Advisory
• https://cert.pl/en/posts/2025/05/CVE-2025-3893 · Note
• https://t.me/cvetracker/24527 · Telegram Post
• https://twitter.com/CveFindCom/status/1925864512118272414 · Twitter Post
• https://t.me/cvenotify/123424 · Telegram Post
• https://t.me/latest_high_impact_cve/2445 · Telegram Post
• https://t.me/cvenotify/123423 · Telegram Post
• https://t.me/cvenotify/123422 · Telegram Post
• https://gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej · Note
• https://twitter.com/CVEnew/status/1925879143410905254 · Twitter Post