PT-2025-5485 · Enituretechnology · Enituretechnology Ltl Freight Quotes – Worldwide Express Edition
Colin Xu
·
Published
2025-01-27
·
Updated
2025-02-01
·
CVE-2025-24664
CVSS v3.1
9.3
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Eniture Technology LTL Freight Quotes – Worldwide Express Edition versions 5.0.20 and earlier
Description
The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This means an attacker can inject SQL commands, potentially leading to data manipulation or extraction. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.
Recommendations
For Eniture Technology LTL Freight Quotes – Worldwide Express Edition versions 5.0.20 and earlier, update to a version later than 5.0.20 to resolve the issue. As a temporary workaround, consider restricting access to sensitive SQL commands or disabling the functionality that allows user input in SQL commands until a patch is available. Avoid using user-supplied input in SQL commands to minimize the risk of exploitation.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Enituretechnology Ltl Freight Quotes – Worldwide Express Edition