PT-2025-42894 · Unknown · Log2Space Subscriber Management

Published 2025-10-21 · Updated 2025-10-21 · CVE-2025-56450

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Log2Space Subscriber Management Software version 1.1

Description Log2Space Subscriber Management Software version 1.1 contains a SQL injection flaw. An attacker can send a crafted POST request to the /l2s/api/selfcareLeadHistory endpoint, exploiting the lead id parameter. The backend does not properly sanitize user input, which could allow an attacker to enumerate database schemas and table names, potentially leading to full database compromise.

Recommendations Apply input sanitization and validation to the lead id parameter in the /l2s/api/selfcareLeadHistory endpoint.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-56450

Affected Products

Log2Space Subscriber Management

References · 5

• 🔥 https://github.com/apboss123/CVE-2025-56450/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56450 · Security Note
• https://reference1.example.com/selfcare/login · Note
• https://t.me/CVEtracker/35401 · Telegram Post
• https://t.me/cveNotify/139632 · Telegram Post