PT-2025-47106 · Unknown · Beims Contractor Web

Nicholas Page · Published 2025-11-16 · Updated 2025-11-17 · CVE-2025-10460

Positive Technologies (AI Summary)

CVSS v2.0

9.7

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions BEIMS Contractor Web versions prior to 5.7.139

Description A SQL Injection issue exists in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor. This allows an unauthorized user to retrieve sensitive database contents through unsanitized parameter input. The issue occurs due to improper input validation on the /BEIMSWeb/contractor.asp endpoint. Successful exploitation requires the contractor.asp endpoint to be open to the internet and allows attackers to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the database.

Recommendations Versions prior to 5.7.139 are vulnerable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-14495

CVE-2025-10460

Affected Products

Beims Contractor Web

References · 11

• https://bdu.fstec.ru/vul/2025-14495 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-10460 · Security Note
• https://help.fmiworks.com/knowledge/contractor-web-operational-requirements · Note
• https://help.fmiworks.com/knowledge/beims-web · Note
• https://twitter.com/CVEnew/status/1990252110756077979 · Twitter Post
• https://t.me/cveNotify/142963 · Telegram Post
• https://t.me/CVEtracker/37460 · Telegram Post
• https://vulners.com/cve/CVE-2025-10460 · Note
• https://twitter.com/0dayPublishing/status/1990256043440349245 · Twitter Post
• https://twitter.com/offseq/status/1990254018900140307 · Twitter Post
• https://twitter.com/transilienceai/status/1990261562511167842 · Twitter Post