CVE-2025-1809
Published: 02 March 2025
Description
A vulnerability was found in Pixsoft Sol up to 7.6.6c and classified as critical. This issue affects some unknown processing of the file /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041 of the component Login Endpoint. The manipulation of the argument txtUsuario leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Security Summary
CVE-2025-1809 is a critical SQL injection vulnerability in Pixsoft Sol versions up to 7.6.6c. It affects the processing of the /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041 endpoint in the Login component, where manipulation of the txtUsuario argument triggers the issue. Classified under CWE-74 and CWE-89, the vulnerability has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers can exploit this vulnerability without authentication or user interaction, requiring only low attack complexity. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via SQL injection payloads.
VulDB advisories and related references, including GitHub repositories, document the issue but provide no official patches or mitigations from the vendor, who was contacted early but did not respond. The exploit has been publicly disclosed and is available for use.
Notable context includes the public availability of the exploit code on GitHub, increasing the risk of active exploitation against unpatched Pixsoft Sol instances.
Details
- CWE(s)