CVE-2025-26348
Published: 12 February 2025
Summary
CVE-2025-26348 is a medium-severity SQL Injection (CWE-89) vulnerability in Q-Free Maxtime. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection (CWE-89) by requiring validation and neutralization of special elements in inputs to the editUserMenu endpoint's SQL commands.
Remediates the specific SQL injection flaw in maxprofile/menu/model.lua through timely patching or code correction for Q-Free MaxTime <= 2.11.0.
Boundary protection with web application firewalls inspects and blocks crafted HTTP requests targeting the vulnerable editUserMenu endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability enables exploitation of public-facing web application (T1190) and arbitrary SQL command execution, facilitating data collection from databases (T1213.006), stored data manipulation (T1565.001), and data destruction (T1485).
NVD Description
A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted…
more
HTTP requests.
Deeper analysisAI
CVE-2025-26348, published on 2025-02-12, is an SQL injection vulnerability (CWE-89) in the editUserMenu endpoint of maxprofile/menu/model.lua in Q-Free MaxTime versions less than or equal to 2.11.0. The flaw stems from improper neutralization of special elements used in an SQL command, enabling an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
An attacker requires high privileges (PR:H) to exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows arbitrary SQL command execution, resulting in high integrity impact (I:H) such as data modification and low availability impact (A:L), with no confidentiality impact (C:N) and unchanged scope (S:U), as reflected in its CVSS v3.1 base score of 5.5.
For mitigation guidance, refer to the vulnerability advisory from Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26348.
Details
- CWE(s)