EUVD-2025-210741
GHSA-76p9-g6m2-hj7q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, unauthenticated, no interaction required per CVSS 4.0 PR:N; no integrity impact demonstrated; scope unchanged as exploitation is confined to the application and its database.
Primary rating from Vendor (Kaspersky).
CVSS VectorVendor: Kaspersky
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
AnalysisAI
Blind SQL injection in vsDesk (vsdesk.ru) exposes database contents and can render the application unresponsive via unauthenticated network requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote exploitation requiring no privileges or user interaction, with high confidentiality and availability impact. No active exploitation or public proof-of-concept has been identified at time of analysis; a vendor-released patch is available in version 14.0101 and later.
Technical ContextAI
vsDesk is a Russian-market IT helpdesk and service management application developed by vsdesk.ru. The vulnerability stems from improper sanitization of user-supplied input that is concatenated directly into SQL query strings - the classic CWE-89 (Improper Neutralization of Special Elements in SQL Commands) pattern, though no CWE was formally assigned in this advisory. The affected component processes HTTP request parameters without parameterized queries or adequate escaping, enabling an attacker to manipulate query logic. The 'blind' nature of the injection indicates the application does not directly return database error messages; instead, exploitability is confirmed through boolean-based or time-based inference techniques. CPE cpe:2.3:a:vsdesk:vsdesk:*:*:*:*:*:*:*:* indicates all versions prior to 14.0101 are affected.
RemediationAI
Upgrade vsDesk to version 14.0101 or later, which contains the vendor-released patch per the advisory at https://vsdesk.ru/. Until patching is possible, restrict network access to the vsDesk application to trusted internal IP ranges via firewall rules or a reverse proxy with IP allowlisting - this directly reduces the AV:N unauthenticated attack surface. Deploying a Web Application Firewall (WAF) with SQL injection detection rules can detect and block exploitation attempts, though WAF bypass is possible against blind injection techniques. Database-level controls such as least-privilege database accounts (read-only where write is not needed) can limit the blast radius of successful exploitation. Monitor database query logs for anomalous timing patterns or boolean-condition probing characteristic of blind SQL injection. There are no known functional trade-offs to applying the vendor patch.
Unauthenticated administrative account takeover in vsDesk (a Russian-market IT service-desk/help-desk platform) lets a r
OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary oper
File enumeration in vsDesk service desk software allows remote authenticated attackers to predict and retrieve uploaded
Share
External POC / Exploit Code
Leaving vuln.today