EUVD-2025-208933
GHSA-x9c9-7xxr-rwfg
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
4Description
SQL Injection in Cuantis. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'search' parameter in the '/search.php' endpoint.
Analysis
A SQL injection vulnerability exists in Cuantis that allows unauthenticated attackers to execute arbitrary SQL commands through the 'search' parameter in the '/search.php' endpoint. This vulnerability enables complete database compromise including retrieval, creation, modification, and deletion of database contents. A patch is available from the vendor, and exploitation requires only network access to the affected application with no special privileges or user interaction.
Technical Context
The vulnerability is a classic SQL injection flaw (CWE-89) in a PHP-based application (Cuantis) where user input from the 'search' parameter is not properly sanitized or parameterized before being passed to SQL queries. The affected product is identified via CPE as cpe:2.3:a:cuantis:cuantis:*:*:*:*:*:*:*:*, indicating all versions of Cuantis are potentially vulnerable. The '/search.php' endpoint fails to use prepared statements or input validation, allowing attackers to inject malicious SQL syntax directly into database queries. This is a server-side vulnerability in the PHP application layer, exploitable remotely through HTTP GET or POST requests.
Affected Products
All versions of Cuantis are affected according to the CPE specification cpe:2.3:a:cuantis:cuantis:*:*:*:*:*:*:*:*, which indicates no version exclusions. The vulnerability was reported to INCIBE (Spanish National Cybersecurity Institute) and confirmed in the Cuantis PHP application. Organizations using any deployed version of Cuantis should immediately verify their installation and apply the available patch from the vendor, details of which are available in the INCIBE-CERT security notice at https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-cuantis.
Remediation
Apply the vendor-supplied patch immediately, available from INCIBE-CERT at https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-cuantis. If immediate patching is not feasible, implement network segmentation to restrict access to the '/search.php' endpoint to trusted IP ranges only, disable the search functionality at the web server level using URL rewriting rules, and implement Web Application Firewall (WAF) rules to block SQL injection patterns in the search parameter such as common injection keywords (UNION, SELECT, DROP, etc.). Additionally, review database user permissions to ensure the Cuantis application account operates with minimal necessary privileges (least privilege principle) to limit damage from successful injection attempts. Monitor application logs for suspicious SQL syntax patterns and database access anomalies.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today