CVE-2025-40677

HIGH

SQL injection vulnerability in Summar Software´s Portal del Empleado

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-40677 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 18, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Portal del Empleado

Browse Summar Software / Portal del Empleado

Default status: unaffected

CVE List3.98.0affected

Proofs of concept

2

Catalogued exploits

ExploitDBSummar Employee Portal 3.98.0 - Authenticated SQL InjectionExploitDB exploitby Peter GabaldonScanner1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a sqlmap command and a sample HTTP POST request to test for an authenticated SQL injection vulnerability in Summar Employee Portal 3.98.0. It does not contain any custom exploit code, payloads, or scripts; it only demonstrates how to use the existing sqlmap tool to scan for the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a text file containing a publicly known CVE description and a sample HTTP POST request demonstrating an authenticated SQL injection vulnerability in Summar Employee Portal. The file includes a sqlmap command line and a request body with a marked injection point. No hidden commands, obfuscated payloads, or actions beyond the described exploit are present. The file does not contain any executable code, and the review is limited to the supplied text.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagestext
Target softwareSummar Employee Portal
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact only provides a command to run the sqlmap scanner and a sample request file. It does not include any custom exploit code, payloads, or scripts to directly exploit the vulnerability. The description explicitly states it is a 'sqlmap' command, which is a well-known SQL injection detection and exploitation tool, but the artifact itself only demonstrates how to scan.

exploits/multiple/webapps/52462.txt:12

Requirements

  • Requires authenticated session (valid cookies) to access the vulnerable endpoint.exploits/multiple/webapps/52462.txt:16
  • Requires sqlmap tool to be installed.exploits/multiple/webapps/52462.txt:12

Observed behavior

  • The artifact provides a sqlmap command line that uses a request file to scan the 'payload withheld' parameter for SQL injection.exploits/multiple/webapps/52462.txt:12
  • The artifact provides a sample HTTP POST request targeting /MemberPages/quienesquien.aspx with a placeholder for the SQL injection point.exploits/multiple/webapps/52462.txt:14-31
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Usage
Payload withheldThe file provides a sqlmap command and a sample HTTP POST request to exploit an authenticated SQL injection vulnerability, consistent with the described CVE.exploits/multiple/webapps/52462.txt:12exploits/multiple/webapps/52462.txt:14-31
Vulnerability Parameter
Payload withheldThe parameter marked as the SQL injection point in the POST request body.exploits/multiple/webapps/52462.txt:31
Review boundaries

What the analysis did not establish

  • The request file 'req.sqli.xml' referenced in the sqlmap command is not included in the evidence.
  • The artifact does not contain any custom exploit code or payloads; it only provides a command to use an external tool.
  • Review is based solely on the supplied text file; no external resources, linked tools, or the target application were analyzed.
  • The file references a sqlmap command and a request file (req.sqli.xml) that are not included in the evidence; their contents are unknown.
  • The HTTP request contains redacted Host and Cookie values, and truncated VIEWSTATE parameters, which may obscure additional context.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubPeterGabaldon/CVE-2025-40677Repository PoCby PeterGabaldon1Scanner1 file

1.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file that documents an authenticated SQL injection vulnerability (CVE-2025-40677) in Summar Employee Portal. It provides a sqlmap command and a sample HTTP POST request to detect and exploit the vulnerability, but does not contain standalone exploit code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file documenting an authenticated SQL injection vulnerability (CVE-2025-40677) in Summar Employee Portal. It contains no executable code, no obfuscated payloads, and no instructions for the reviewer to perform any action. The content is a standard public exploit disclosure with a sqlmap command example and a sample HTTP request.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesMarkdown
Target softwareSummar Employee Portal
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is to document how to use sqlmap to detect the SQL injection vulnerability. It provides a command and a request template for scanning, not a standalone script that directly exploits the vulnerability. The file is classified as a scanner because it instructs the user on how to check for the vulnerability using an external tool.

README.md:1-33

Requirements

  • Valid authenticated session (cookies) for the target applicationREADME.md:17
  • Target running Summar Employee Portal version < 3.98.0README.md:7

Observed behavior

  • Provides a sqlmap command to scan for SQL injection in the 'ctl00$ContentPlaceHolder1$filtroNombre' parameter of '/MemberPages/quienesquien.aspx'README.md:13
  • Includes a sample HTTP POST request with the vulnerable parameter marked as [SQL_INJECTION_POINT]README.md:15-32
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Sqlmap Command
Payload withheldExample command for exploiting the described SQL injection vulnerability using the sqlmap tool.README.md:13
Http Request Example
Payload withheldSample HTTP request demonstrating the vulnerable parameter for the disclosed CVE.README.md:15-32
Review boundaries

What the analysis did not establish

  • The artifact is a single README.md file; no executable source code is present.
  • The analysis is based solely on the provided text; the sqlmap command and request template were not executed.
  • The HTTP request contains redacted values for Host and Cookie, and truncated VIEWSTATE values, which may limit reproducibility.
  • Only the README.md file was reviewed; no other files exist in the repository snapshot.
  • The analysis is limited to static text review; no dynamic or behavioral analysis was performed.
  • The artifact is a documentation-only PoC; the described exploit targets a third-party application, not the reviewer.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2