CVE-2025-25181
Advantive VeraCore SQL Injection Vulnerability
Description
CVE-2025-25181 is a medium-severity SQL injection vulnerability in Advantive VeraCore, specifically in the timeoutWarning.asp page. A remote unauthenticated attacker can inject arbitrary SQL commands through the PmSess1 parameter, potentially extracting sensitive data from the backend database. Rated 5.8 on CVSS v3.1 with MEDIUM severity, the vulnerability has a changed scope meaning it can impact resources beyond the vulnerable component. CISA has added CVE-2025-25181 to the KEV catalog with a deadline of 2025-03-31, and its EPSS score of 79.71% at the 99.1th percentile places it among the top 1% of vulnerabilities by exploitation likelihood, linked to campaigns by the XE Group.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| advantive | veracore | < 2025.1.1.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://advantive.my.site.com/support/s/knowledge(Product, Release Notes)
- https://intezer.com/blog/research/xe-group-exploiting-zero-days/(Exploit, Technical Description, Third Party Advisory)
- https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/(Exploit, Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25181(US Government Resource)
Weakness Type
CWE-89: SQL Injection
CVE-2025-25181 is classified under CWE-89 (SQL Injection), which occurs when user-supplied input is incorporated into SQL queries without proper sanitization or parameterization. In Advantive VeraCore, the timeoutWarning.asp page directly concatenates the PmSess1 parameter value into a SQL query, allowing attackers to inject arbitrary SQL commands that can read, modify, or delete database contents.
Learn more: CWE-89 — SQL Injection
Impact Analysis
The impact of CVE-2025-25181 primarily affects confidentiality with a changed scope (S:C), meaning data from the underlying database and potentially other systems can be accessed. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality (Low): The SQL injection allows extraction of data from the VeraCore database, though the CVSS rating suggests limited direct data exposure per query. However, iterative exploitation can extract substantial volumes of data including customer records, credentials, order information, and internal configuration data. The changed scope indicates the vulnerability can be leveraged to access resources beyond the VeraCore database, potentially including other databases on the same server. With a CVSS score of 5.8 (MEDIUM) and an EPSS score of 79.71% at the 99.1th percentile, this vulnerability has been actively exploited by the XE Group, often in combination with CVE-2024-57968 for complete system compromise.
Exploit Maturity
CVE-2025-25181 demonstrates high exploit maturity with confirmed active exploitation by the XE Group threat actor. CISA has added this vulnerability to the KEV catalog, and detailed technical analysis of the exploitation campaign is available via Intezer and Solis Security. The EPSS score of 79.71% at the 99.1th percentile places it in the top 1% of all vulnerabilities by exploitation likelihood, reflecting active and sustained exploitation campaigns. The ransomware association is classified as unknown. The XE Group has been observed chaining this SQL injection vulnerability with CVE-2024-57968 (unrestricted file upload) to first enumerate the target environment via SQL injection and then deploy web shells through the file upload flaw for persistent access.
Remediation
-
Upgrade Advantive VeraCore to version 2025.1.1.3 or later. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Check the Advantive Knowledge Base for the latest release and upgrade instructions.
-
Deploy a web application firewall (WAF) with SQL injection detection rules specifically targeting the timeoutWarning.asp endpoint and the PmSess1 parameter. Configure the WAF to block requests containing SQL syntax, union statements, and other injection patterns.
-
Implement parameterized queries at the application level if custom code interacts with the VeraCore database. Review all ASP pages for similar SQL injection patterns, as the timeoutWarning.asp vulnerability may indicate systemic input validation weaknesses.
-
Audit the database for compromise indicators including unauthorized data access, new user accounts, modified stored procedures, and evidence of data exfiltration. The XE Group is known to use SQL injection for reconnaissance before deploying web shells through related vulnerabilities.
-
Restrict network access to the VeraCore application to authorized users and networks only. Implement authentication requirements for all application endpoints, and deploy monitoring for SQL injection attack patterns in web server logs and database audit logs.
Technical Details
CVE-2025-25181 is a SQL injection vulnerability (CWE-89) in Advantive VeraCore with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. The vulnerability exists in the timeoutWarning.asp page, which accepts the PmSess1 parameter and incorporates its value directly into a SQL query without parameterization or input sanitization. An unauthenticated remote attacker can inject arbitrary SQL commands through this parameter, allowing database enumeration, data extraction, and potentially database manipulation. The changed scope (S:C) in the CVSS vector indicates the SQL injection can impact resources beyond the VeraCore application database, potentially including other databases on the same server or the underlying operating system through features like xp_cmdshell. The low confidentiality impact (C:L) in the CVSS scoring suggests that each individual injection produces limited data disclosure, but iterative or UNION-based injection techniques can be used to extract complete database contents. The network vector (AV:N), low complexity (AC:L), no authentication (PR:N), and no user interaction (UI:N) confirm this is a trivially exploitable remotely accessible SQL injection that the XE Group chains with CVE-2024-57968 for complete system compromise.
Frequently Asked Questions
Is CVE-2025-25181 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2025-25181 to the KEV catalog. The XE Group threat actor has been observed exploiting this SQL injection in combination with CVE-2024-57968. The EPSS score of 79.71% at the 99.1th percentile places it in the top 1% of exploited vulnerabilities.
What products are affected by CVE-2025-25181?
Adventive VeraCore versions prior to 2025.1.1.3 are affected. The vulnerability is in the timeoutWarning.asp page, which is present in all VeraCore web installations.
How do I fix CVE-2025-25181?
Upgrade to Advantive VeraCore 2025.1.1.3 or later. Deploy WAF rules to block SQL injection on the timeoutWarning.asp endpoint, audit the database for compromise indicators, and restrict network access to the VeraCore application.
How severe is CVE-2025-25181?
CVE-2025-25181 has a CVSS score of 5.8 (MEDIUM) with a changed scope allowing impact beyond the VeraCore database. While individually rated as medium severity, the XE Group chains this SQL injection with CVE-2024-57968 for complete system compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.