CVE-2025-10460
BaseFortify
Publication date: 2025-11-17
Last updated on: 2025-11-17
Assigner: MON-CSIRT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| beims | contractor_web | 5.7.139 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL Injection in the BEIMS Contractor Web product, specifically on the /BEIMSWeb/contractor.asp endpoint. It occurs because the application does not properly validate input parameters, allowing an unauthorized user to inject and execute arbitrary SQL commands. This can lead to unauthorized retrieval of sensitive database contents.
How can this vulnerability impact me? :
Exploitation of this vulnerability can compromise the confidentiality, integrity, and potentially the availability of the database. An attacker could retrieve sensitive information, alter data, or disrupt database operations, leading to significant security risks.
What immediate steps should I take to mitigate this vulnerability?
Since the product is legacy and no longer maintained or patched by the vendor, immediate mitigation steps include restricting or blocking access to the /BEIMSWeb/contractor.asp endpoint from the internet, implementing network-level controls such as firewalls or web application firewalls (WAF) to filter and block malicious SQL injection attempts, and considering isolating or decommissioning the vulnerable system if possible. Additionally, monitoring for unusual database activity may help detect exploitation attempts.