PT-2025-48395 · Qualitor · Qualitor

Dante Michelon + 2 · Published 2025-11-30 · Updated 2025-12-07 · CVE-2025-13792

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualitor versions prior to 8.20.105 and prior to 8.24.98

Description A security flaw exists in Qualitor that allows for code injection. The eval function within the file /html/st/stdeslocamento/request/getResumo.php is affected. Manipulation of the passageiros argument can lead to code injection, and remote exploitation is possible. The exploit for this issue has been publicly released.

Recommendations Qualitor versions prior to 8.20.105 should be upgraded. Qualitor versions prior to 8.24.98 should be upgraded.

Exploit

Fix

RCE

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2025-13792

Affected Products

Qualitor

References · 13

• 🔥 https://youtube.com/watch?v=hU8YbFc6KpI · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13792 · Security Note
• https://t.me/cveNotify/145024 · Telegram Post
• https://qualitor.com.br/official-security-advisory-cve-2025-13792 · Note
• https://vuldb.com/?submit.691251 · Note
• https://vuldb.com/?id.333796 · Note
• https://twitter.com/cracbot/status/1996897385470107999 · Twitter Post
• https://t.me/cveNotify/144349 · Telegram Post
• https://vuldb.com/?ctiid.333796 · Note
• https://vuldb.com/?submit.704314 · Note
• https://twitter.com/MatheuzSecurity/status/1995861128988315802 · Twitter Post
• https://t.me/CVEtracker/38491 · Telegram Post
• https://twitter.com/CVEnew/status/1995165546380231145 · Twitter Post