CVE-2025-25181
Advantive VeraCore SQL Injection Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 31 March 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 57.03% probability · 99th percentile
- CISA KEV
- Listed 10 March 2025 · due 31 March 2025
- Weakness
- CWE-89
- Affected
- advantive/veracore
- Source
- cve@mitre.org
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://advantive.my.site.com/support/s/article/Veracore-Release-Notes-2025-1-1-3 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25181
References
- https://advantive.my.site.com/support/s/knowledgeProduct, Release Notes
- https://intezer.com/blog/research/xe-group-exploiting-zero-days/Exploit, Technical Description, Third Party Advisory
- https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/Exploit, Technical Description, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25181US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.