What is the CVSS score of CVE-2025-40655?

CVE-2025-40655 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-40655?

Within 24 hours: Identify all instances of DM Corporative CMS in your environment and verify patch availability status from vendor. Within 7 days: Apply vendor-released patch to all affected DM Corporative CMS systems, prioritizing internet-facing instances; implement network segmentation or WAF rules to block requests to /antcatalogue.asp if immediate patching is not feasible. Within 30 days: Conduct comprehensive database audit to identify unauthorized access, execute security testing to confirm remediation, and review access logs for signs of exploitation.

Dm Corporative Cms CVE-2025-40655

Q: Which versions of Dm Corporative Cms are affected by CVE-2025-40655?

CVE-2025-40655 is a critical SQL injection vulnerability in DM Corporative CMS that allows unauthenticated remote attackers to execute arbitrary database commands, potentially exposing or…. A patch is available.

EUVD-2025-17654 CRITICAL

SQL Injection (CWE-89)

2025-06-10 cve-coordination@incibe.es

SQLi Information Disclosure Dm Corporative Cms

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:54 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2025.01

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17654

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 10:15 nvd

CRITICAL 9.8

DescriptionCVE.org

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name parameter in /antcatalogue.asp.

AnalysisAI

Critical SQL injection vulnerability in DM Corporative CMS affecting the /antcatalogue.asp endpoint's 'name' parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands with complete database compromise (retrieval, creation, modification, deletion). With a CVSS 9.8 score, zero authentication requirements, and network-accessible attack surface, this vulnerability represents an immediate and severe risk to all exposed instances; exploitation likelihood is extremely high given the straightforward injection point and lack of input validation.

Technical ContextAI

The vulnerability exists in DM Corporative CMS's ASP-based application layer, specifically the /antcatalogue.asp endpoint which processes user-supplied input through the 'name' parameter without proper sanitization or parameterized queries. This is a classic CWE-89 (SQL Injection) vulnerability where dynamic SQL construction concatenates unsanitized user input directly into database queries. The ASP framework processes these malicious SQL statements server-side against the backend database (likely SQL Server, Microsoft Access, or similar), allowing attackers to manipulate query logic. The lack of input validation, absence of prepared statements, and no apparent Web Application Firewall (WAF) protections compound the issue. Affected systems run DM Corporative CMS on Windows/IIS infrastructure with Active Server Pages technology.

RemediationAI

Immediate Actions (Priority 0): Isolate or take offline affected DM Corporative CMS instances until patching is complete; disable the /antcatalogue.asp endpoint if not critical; implement emergency network-level access restrictions (firewall rules limiting /antcatalogue.asp access to trusted IPs only). 2. Input Validation (Temporary Mitigation): If patching cannot be immediate, implement whitelist-based input validation on the 'name' parameter accepting only alphanumeric characters; deploy Web Application Firewall (WAF) rules blocking SQL injection patterns (single quotes, UNION, SELECT, DROP, etc.). 3. Patching (Primary Remediation): Contact DM Corporative immediately for security patches; install latest patched version once released and validated in test environment; apply vendor-supplied patches to /antcatalogue.asp specifically addressing parameterized query usage. 4. Code-Level Fix: Replace dynamic SQL string concatenation with prepared statements/parameterized queries (ADO.NET parameters in ASP); implement input validation and output encoding; conduct security code review of similar vulnerable endpoints. 5. Detection & Monitoring: Deploy IDS/IPS rules detecting SQL injection attempts to /antcatalogue.asp; monitor database query logs for suspicious SQL syntax; implement SIEM alerting for exploitation attempts. 6. Vendor Advisory: Check https://www.dm-corporative.com or relevant vendor security bulletins for official patches and guidance (specific link depends on vendor disclosure). 7. Validate Remediation: Test patched systems against known SQL injection payloads in controlled environment before production deployment.