CVE-2025-40618 — SQL injection vulnerability in Bookgy

CVE-2025-40618

SQL injection vulnerability in Bookgy PUBLISHED

Description (CNA)

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDRESERVA" parameter in /bkg_imprimir_comprobante.php

Affected (CNA)

Vendor / product	Versions
Bookgy / Bookgy	affected all versions

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bookgy

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.