CVE-2025-40617 — SQL injection vulnerability in Bookgy

CVE-2025-40617

SQL injection vulnerability in Bookgy PUBLISHED

Description (CNA)

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkg_seleccionar_hora_ajax.php.

Affected (CNA)

Vendor / product	Versions
Bookgy / Bookgy	affected all versions

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bookgy

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.