EUVD-2025-28309
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Ladó PostaPanduri allows SQL Injection. This issue affects PostaPanduri: from n/a through 2.1.3.
AnalysisAI
Critical SQL injection vulnerability in Adrian Ladó's PostaPanduri application (versions up to 2.1.3) that allows unauthenticated remote attackers to execute arbitrary SQL commands. The vulnerability has a CVSS score of 9.3 with network-based attack vector and no authentication required, enabling attackers to extract sensitive data from the database and potentially cause service disruption. Real-world exploitation risk is elevated due to the complete lack of authentication requirements and straightforward attack vector.
Technical ContextAI
PostaPanduri is a web application framework/CMS developed by Adrian Ladó. The vulnerability stems from improper neutralization of special SQL metacharacters in user-supplied input (CWE-89), indicating that the application fails to properly sanitize or parameterize SQL queries. This is a classic SQL injection flaw where user input is concatenated directly into SQL commands without proper escaping, prepared statements, or input validation. The affected software processes user input through web interfaces that construct dynamic SQL queries, allowing attackers to manipulate query logic by injecting SQL syntax (e.g., UNION, OR, DROP, SELECT). CPE identifier would be: cpe:2.3:a:adrian_lado:postapanduri:*:*:*:*:*:*:*:* with versions from unspecified through 2.1.3 marked as vulnerable.
Share
External POC / Exploit Code
Leaving vuln.today