PT-2025-42433 · Sergestec · Sergestec Exito

Ignacio Aldarabi · Published 2025-10-16 · Updated 2025-10-21 · CVE-2025-41018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sergestec Exito version 8.0

Description A SQL injection issue exists in Sergestec Exito version 8.0. This allows an attacker to retrieve, create, update, and delete databases. The vulnerability is present in the 'cat' parameter of the '/public.php' API endpoint. The cat parameter is susceptible to manipulation, potentially granting unauthorized database access.

Recommendations Apply a fix for Sergestec Exito version 8.0 to address the SQL injection issue in the '/public.php' endpoint.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-41018

Affected Products

Sergestec Exito

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-41018 · Security Note
• https://osv.dev/vulnerability/CVE-2025-41018 · Vendor Advisory
• https://t.me/cveNotify/138916 · Telegram Post
• https://t.me/cveNotify/139583 · Telegram Post
• https://twitter.com/CveFindCom/status/1978735045268394279 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sergestec-products · Note
• https://twitter.com/CVEnew/status/1978926635018543157 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978762139352350861 · Twitter Post