EUVD-2025-208935
GHSA-8wgh-35g5-cg6v
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
3Description
SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint.
Analysis
A SQL injection vulnerability exists in Sinturno that allows unauthenticated or low-privileged attackers to execute arbitrary SQL commands through the 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint. This vulnerability enables complete database compromise including retrieval, creation, updating, and deletion of database objects. The vulnerability was reported by INCIBE and affects all versions of Sinturno; no CVSS score, EPSS data, or KEV status has been published, but the ability to perform CRUD operations on databases represents critical severity regardless of formal scoring.
Technical Context
Sinturno is a PHP-based application identified via CPE (cpe:2.3:a:sinturno:sinturno:*:*:*:*:*:*:*:*), and this vulnerability represents a classic SQL injection flaw classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint fails to properly sanitize or parameterize user input before incorporating it into SQL queries. This PHP application likely uses direct string concatenation or inadequate prepared statement implementation when constructing SQL commands, allowing attackers to break out of the intended query context and inject malicious SQL syntax.
Affected Products
Sinturno in all versions is affected, as indicated by the CPE string cpe:2.3:a:sinturno:sinturno:*:*:*:*:*:*:*:*. No version-specific patching information has been published. The vulnerability was reported by INCIBE-CERT, and affected organizations should consult the official notice at https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sinturno for vendor remediation guidance and patch availability.
Remediation
Immediately contact Sinturno vendors or maintainers for security patches addressing SQL injection in the modalReport_data.php endpoint; apply patches to all instances as they become available. Until patches are deployed, implement immediate mitigations: enforce strict input validation and parameterized queries (prepared statements) for the 'client' parameter and all user-supplied inputs in the affected endpoint; deploy Web Application Firewall (WAF) rules to block SQL injection syntax in HTTP requests; restrict network access to the '/_adm/' administrative path to trusted IP ranges only; and conduct a full database audit for signs of unauthorized access or data exfiltration. Refer to INCIBE's advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sinturno for official patch release information.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today