Very High
CVE-2025-25181
Very High
(1 user assessed)
Very High
(1 user assessed)Unknown
Unknown
Unknown
CVE-2025-25181
Description
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.
Add Assessment
Technical Analysis
CVE-2025-25181 is an SQL Injection vulnerability identified in the VeraCore application, specifically within the timeoutWarning endpoint. This flaw arises because the application constructs SQL queries by concatenating a user-supplied parameter (PmSess1) directly into the query string without proper sanitization. Consequently, an attacker can manipulate the PmSess1 parameter to execute arbitrary SQL commands against the application’s database.
The XE Group, a cybercriminal organization active since at least 2013, exploited this vulnerability to gain unauthorized access to systems running the VeraCore software. By leveraging CVE-2025-25181, they retrieved valid credentials from the database, which were subsequently used to exploit an upload feature within the application. This allowed them to upload malicious webshells, facilitating remote code execution and persistent access to the compromised systems.
[source used to explain and summarize the vulnerability: https://intezer.com/blog/research/xe-group-exploiting-zero-days/]
CVSS V3 Severity and Metrics
General Information
References
