PT-2025-25533 · Unknown · Customer Support System

Rafael Pedrero · Published 2025-06-16 · Updated 2025-10-09 · CVE-2025-40728

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Customer Support System version 1.0

Description This issue allows an authenticated attacker to retrieve, create, update, and delete databases via the id parameter in the "/customer support/manage user.php" endpoint.

Recommendations For Customer Support System version 1.0, consider disabling the /customer support/manage user.php endpoint until a patch is available to prevent exploitation. Restrict access to the id parameter in the affected endpoint to minimize the risk of database manipulation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-40728

Affected Products

Customer Support System

References · 9

• https://osv.dev/vulnerability/CVE-2025-40728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40728 · Security Note
• https://t.me/cveNotify/138000 · Telegram Post
• https://t.me/cvetracker/26291 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-customer-support-system · Note
• https://twitter.com/CVEnew/status/1934534119632822524 · Twitter Post
• https://t.me/cvenotify/125756 · Telegram Post
• https://t.me/latest_high_impact_cve/2669 · Telegram Post
• https://twitter.com/CveFindCom/status/1934538895833657482 · Twitter Post