{"id":"CVE-2025-1751","state":"PUBLISHED","title":"SQL Injection CIGES","description":"A SQL Injection vulnerability has been found in Ciges 2.15.5 from ATISoluciones. This vulnerability allows an attacker to retrieve, create, update and delete database via $idServicio parameter in /modules/ajaxBloqueaCita.php endpoint.","publishedAt":"2025-02-27T12:03:10.610Z","updatedAt":"2025-02-27T14:42:34.087Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"ATIS"},"assigner":"ATIS","products":["ATISoluciones CIGES"],"affected":[{"vendor":"ATISoluciones","product":"CIGES","defaultStatus":"unaffected","versions":[{"version":"2.15.5","status":"affected"}]}],"references":["https://www.atisoluciones.com/incidentes-cve"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1751.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1751","state":"PUBLISHED","datePublished":"2025-02-27T12:03:10.610Z","dateUpdated":"2025-02-27T14:42:34.087Z","assignerShortName":"ATIS","assignerOrgId":"68e1e1d3-5247-4d65-9f39-ef1a02cf571e","dateReserved":"2025-02-27T11:17:37.585Z"},"containers":{"cna":{"title":"SQL Injection CIGES","descriptions":[{"lang":"en","value":"A SQL Injection vulnerability has been found in Ciges 2.15.5 from ATISoluciones. This vulnerability allows an attacker to retrieve, create, update and delete database via $idServicio parameter in /modules/ajaxBloqueaCita.php endpoint."}],"affected":[{"vendor":"ATISoluciones","product":"CIGES","defaultStatus":"unaffected","versions":[{"version":"2.15.5","status":"affected"}]}],"references":[{"url":"https://www.atisoluciones.com/incidentes-cve"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ATIS","orgId":"68e1e1d3-5247-4d65-9f39-ef1a02cf571e","dateUpdated":"2025-02-27T12:03:10.610Z"},"credits":[{"lang":"en","type":"finder","value":"Gonzalo Aguilar Garcia (6h4ack)"}],"datePublic":"2025-02-27T11:40:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"All functions involved in <code>ajaxBloqueoCita.php</code> are reviewed, and some queries that cause this vulnerability are found. Prepared statements are then implemented in all of them.\n\nA new version of the software, v2.15.6, has been released to address the detected vulnerabilities.\n\n<br>"}],"value":"All functions involved in ajaxBloqueoCita.php are reviewed, and some queries that cause this vulnerability are found. Prepared statements are then implemented in all of them.\n\nA new version of the software, v2.15.6, has been released to address the detected vulnerabilities."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-27T14:42:22.003408Z","id":"CVE-2025-1751","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-27T14:42:34.087Z"}}]}}}