Vulnerability · Published Apr 14, 2025 · Assigned by DIVD

CVE-2025-22371SQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC

Critical 9.3

In plain English

A critical-severity SQL injection in BASEC from SicommNet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.6%top 51.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time)

Affected products (as reported)

Vendor	Product	Versions
SicommNet	BASEC	14 Dec 2021 – through 16 April 2025 23:00 EST

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:Y/V:C

References

https://basec.sicomm.net/ product
https://csirt.divd.nl/DIVD-2025-00001 third-party-advisory
https://csirt.divd.nl/CVE-2025-22371 third-party-advisory