CVE-2018-25202 - Vulnerability Analysis

Overview

SAT CFDI 3.3 contains an sql injection caused by unsanitized 'id' parameter in the signIn endpoint, letting attackers manipulate database queries and extract sensitive data, exploit requires crafted POST requests.

Severity & Score

Impact

Attackers can extract sensitive data or compromise the application by manipulating database queries.

Mitigation

Update to the latest version with SQL injection mitigations.

References

• https://www.exploit-db.com/exploits/44726
• https://www.vulncheck.com/advisories/sat-cfdi-sql-injection-via-signin-endpoint
• https://www.wecodex.com/item/view/verification-and-validation-system-sat-cfdi-33/8

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner