Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2025-22371

SQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
DIVD

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SicommNet BASEC

Default version status: unknown

  • 14 Dec 2021 to ≤ 16 April 2025 23:00 ESTaffected
  • 16 April 2025 23:00 EST to ≤ *unaffected

References