CVE-2025-1640
Published: 25 February 2025
Summary
CVE-2025-1640 is a medium-severity Injection (CWE-74) vulnerability in Modernasistemas Modernanet. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1640 is a critical SQL injection vulnerability (CWE-74, CWE-89) in Benner ModernaNet versions up to 1.1.0. The flaw affects an unknown functionality within the endpoint /Home/JS_CarregaCombo?formName=DADOS_PESSOAIS_PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS_PESSOAIS_PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc&_=1739290047295, where manipulation of parameters enables SQL injection.
Attackers can exploit this vulnerability remotely without authentication or user interaction, given its low attack complexity as indicated by the CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation grants limited access to confidential data, moderate integrity disruption, and low availability impact on the affected system.
Advisories recommend upgrading to Benner ModernaNet version 1.1.1 to remediate the issue. Further details are documented in VulDB entries and a related GitHub repository tracking the CVE.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4259
Vulnerability details
A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Home/JS_CarregaCombo?formName=DADOS_PESSOAIS_PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS_PESSOAIS_PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc&_=1739290047295. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to…
more
version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in unauthenticated web endpoint enables exploitation of public-facing application (T1190) and blind inference of database information (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection attacks by requiring validation and sanitization of untrusted inputs to the vulnerable endpoint parameters like additionalCondition.
Mitigates the specific flaw by mandating timely identification, reporting, and patching to the fixed version 1.1.1 of Benner ModernaNet.
Supports detection of the SQL injection vulnerability through regular automated scanning of the affected application endpoint.