CVE-2025-41029
SQL Injection in Zeon Academy Pro Allows Database Manipulation
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zeon_global_tech | zeon_academy_pro | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-41029 is a critical SQL injection vulnerability found in Zeon Academy Pro, a school management system developed by Zeon Global Tech.
The vulnerability exists in the '/private/continue-upload.php' endpoint, specifically through the 'phonenumber' POST parameter.
An attacker can exploit this flaw to perform unauthorized database operations such as retrieving, creating, modifying, and deleting data.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows attackers to fully manipulate the database of Zeon Academy Pro.
- Attackers can retrieve sensitive data stored in the database.
- They can create or insert unauthorized data.
- They can modify existing data, potentially corrupting or altering important information.
- They can delete data, causing loss of critical information.
Since the vulnerability requires no privileges or user interaction, it can be exploited remotely and easily, increasing the risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests to the '/private/continue-upload.php' endpoint that include the 'phonenumber' parameter. Specifically, attempts to inject SQL code via this parameter may indicate exploitation attempts.
Commands to detect such activity could include using network monitoring tools or web server logs to filter requests. For example, using grep on web server logs to find POST requests with 'phonenumber' parameter:
- grep -i 'POST /private/continue-upload.php' /var/log/apache2/access.log | grep 'phonenumber='
Additionally, tools like sqlmap can be used to test the endpoint for SQL injection vulnerabilities by targeting the 'phonenumber' parameter.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint '/private/continue-upload.php' to trusted users only, implementing web application firewall (WAF) rules to block SQL injection attempts, and monitoring logs for suspicious activity.
Since no patch or solution has been reported at this time, it is critical to apply input validation and sanitization on the 'phonenumber' parameter if possible, or temporarily disable the vulnerable functionality until a fix is available.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in Zeon Academy Pro allows unauthorized attackers to retrieve, create, update, and delete database information. Such unauthorized access and manipulation of data can lead to breaches of sensitive personal or protected health information.
This kind of vulnerability can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require the protection of personal and health data against unauthorized access and modification.
Since no solution or patch has been reported yet, the risk of non-compliance remains until the vulnerability is addressed.