CVE-2025-25181

CVE-2025-25181 is a SQL injection vulnerability in the timeoutWarning.asp page of Advantive VeraCore, affecting versions through 2025.1.0, in which the unauthenticated PmSess1 parameter is incorporated into a database query without proper sanitization. An attacker triggers it by sending a crafted PmSess1 value in a network request to timeoutWarning.asp, with no credentials or user interaction required. Successful exploitation allows execution of arbitrary SQL commands, with high confidentiality impact — an attacker can read, and potentially manipulate, data in the VeraCore database. Organizations running VeraCore are affected, particularly fulfillment and 3PL providers whose VeraCore web application is exposed to the internet. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-03-10, and reporting indicates the XE Group exploited it (alongside CVE-2024-57968) for years before it was patched.

What to do: Upgrade VeraCore to a fixed release per Advantive's guidance (all versions through 2025.1.0 are affected); as an interim measure, restrict internet exposure of the VeraCore web application and review web-server logs for anomalous PmSess1 values, unusual SQL errors, or unexpected requests to timeoutWarning.asp. Organizations should hunt for signs of compromise given reports of multi-year exploitation by XE Group, including use of the related CVE-2024-57968, and federal agencies must apply mitigations per CISA BOD 22-01 timelines.