PT-2025-48069 · Sigb Pmb · Sigb Pmb

Published 2025-11-25 · Updated 2025-12-01 · CVE-2025-61167

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SIGB PMB version 8.0.1.14

Description The software contains multiple SQL injection flaws in the /opac css/ajax selector.php component. These flaws are triggered through the id and datas parameters. The component is susceptible to manipulation via crafted input to these parameters, potentially allowing unauthorized database access or modification.

Recommendations Apply updates to address the identified SQL injection flaws in the /opac css/ajax selector.php component. As a temporary workaround, restrict access to the id and datas parameters in the /opac css/ajax selector.php component.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-61167

Affected Products

Sigb Pmb

References · 9

• https://osv.dev/vulnerability/CVE-2025-61167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61167 · Security Note
• https://twitter.com/CVEnew/status/1993397930003165313 · Twitter Post
• https://t.me/cveNotify/144400 · Telegram Post
• https://twitter.com/dailycve/status/1995534030977069544 · Twitter Post
• https://gist.github.com/ZanyMonk/ed12e265f777152c33aeb806a644850e · Note
• http://sigb.com · Note
• http://pmb.com · Note
• https://forge.sigb.net/projects/pmb/wiki/Changelog_801#S%C3%A9curit%C3%A9-2 · Note