CVE-2025-1809
Published: 02 March 2025
Summary
CVE-2025-1809 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1809 is a critical SQL injection vulnerability in Pixsoft Sol versions up to 7.6.6c. It affects the processing of the /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041 endpoint in the Login component, where manipulation of the txtUsuario argument triggers the issue. Classified under CWE-74 and CWE-89, the vulnerability has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers can exploit this vulnerability without authentication or user interaction, requiring only low attack complexity. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via SQL injection payloads.
VulDB advisories and related references, including GitHub repositories, document the issue but provide no official patches or mitigations from the vendor, who was contacted early but did not respond. The exploit has been publicly disclosed and is available for use.
Notable context includes the public availability of the exploit code on GitHub, increasing the risk of active exploitation against unpatched Pixsoft Sol instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5555
Vulnerability details
A vulnerability was found in Pixsoft Sol up to 7.6.6c and classified as critical. This issue affects some unknown processing of the file /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041 of the component Login Endpoint. The manipulation of the argument txtUsuario leads to sql injection. The…
more
attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated SQL injection in a public-facing web login endpoint enables initial access via exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation and sanitization of inputs like the txtUsuario argument in the vulnerable login endpoint.
SI-2 mandates timely risk-based remediation of known flaws like CVE-2025-1809, including workarounds or patches despite vendor non-response.
SC-7 implements boundary protections such as web application firewalls to block or detect SQL injection payloads targeting the public login endpoint.