CVE-2025-40728 — SQL injection vulnerability in Customer Support System

CVE-2025-40728

SQL injection vulnerability in Customer Support System PUBLISHED

Description (CNA)

SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databases via the id parameter in the /customer_support/manage_user.php endpoint.

Affected (CNA)

Vendor / product	Versions
Customer Support System / Customer Support System	affected all versions

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-customer-support-system

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.