Advantive VeraCore SQL Injection Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-03-10
• EPSS: 56% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

CISA: Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 31 Mar 2025): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• advantive.my.site.com/support/s/knowledgeProductRelease Notes
• intezer.com/blog/research/xe-group-exploiting-zero-daysExploitTechnical DescriptionThird Party Advisory
• www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-z…ExploitTechnical DescriptionThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource