PT-2025-6108 · Allims · Lab.Online

Stux + 1 · Published 2025-02-10 · Updated 2025-02-11 · CVE-2025-1157

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Allims lab.online versions up to 20250201

Description: A critical issue was found in the processing of the file /model/model recuperar senha.php, where the manipulation of the recuperacao argument leads to SQL injection. This issue can be exploited remotely. The vendor was contacted about the disclosure but did not respond.

Recommendations: For versions up to 20250201, as a temporary workaround, consider restricting access to the /model/model recuperar senha.php file until a patch is available. Avoid using the recuperacao argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-1157

Affected Products

Lab.Online

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-1157 · Security Note
• https://vuldb.com/?ctiid.295061 · Note
• https://twitter.com/CVEnew/status/1889063766886846791 · Twitter Post
• https://vuldb.com/?id.295061 · Note
• https://t.me/cvedetector/17600 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1889132986462806204 · Twitter Post
• https://vuldb.com/?submit.493492 · Note