CVE-2025-22371

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22371
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time)
CVSS

No CVSS.

References
Link Resource
https://basec.sicomm.net/
https://csirt.divd.nl/CVE-2025-22371
https://csirt.divd.nl/DIVD-2025-00001
Configurations

No configuration.

History

21 Apr 2025, 12:15

Type Values Removed Values Added
References
  • {'url': 'https://basec.sicomm.net/login/', 'source': 'csirt@divd.nl'}
  • () https://basec.sicomm.net/ -
Summary (en) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands. This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. As of the date of this CVE record, there has been no patch (en) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time)

15 Apr 2025, 11:15

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando SQL ('Inyección SQL') en SicommNet BASEC (SaaS Service) login page, permite a un atacante remoto no autenticado omitir la autenticación y ejecutar comandos SQL arbitrarios. Este problema afecta a BASEC al menos desde el 14 de diciembre de 2021. Es muy probable que esta vulnerabilidad ya estuviera presente en la solución. A la fecha de este registro CVE, no se ha publicado ningún parche.
References
  • {'url': 'https://cisrt.divd.nl/CVE-2025-22371', 'source': 'csirt@divd.nl'}
  • () https://csirt.divd.nl/CVE-2025-22371 -

14 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-14 16:15

Updated : 2025-04-21 12:15

NVD link : CVE-2025-22371

Mitre link : CVE-2025-22371

CVE.ORG link : CVE-2025-22371

JSON object : View

Products Affected

No product.

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')