CVE-2025-40711
Published: 08 July 2025
Summary
CVE-2025-40711 is a critical-severity SQL Injection (CWE-89) vulnerability in Quiter Quiter Gateway. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-40711 is a SQL injection vulnerability (CWE-89) in versions prior to 4.7.0 of Quiter Gateway by Quiter. The issue affects the id_concesion parameter in the /<Client>FacturaE/VerFacturaPDF endpoint, allowing attackers to retrieve, create, update, and delete database content. Published on 2025-07-08, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high impacts across confidentiality, integrity, and availability.
The vulnerability enables remote exploitation over the network by unauthenticated attackers (PR:N) with low attack complexity (AC:L) and no user interaction (UI:N). Attackers can achieve full database manipulation, including data exfiltration, modification, and destruction, within the unchanged scope (S:U).
The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter provides details on this and other vulnerabilities in Quiterweb, Autoweb, and Quiter products. Security practitioners should consult it for mitigation guidance, such as upgrading to version 4.7.0 or later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20466
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the id_concesion parameter in /<Client>FacturaE/VerFacturaPDF.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of unauthenticated SQL injection in a public web endpoint (/FacturaE/VerFacturaPDF) enabling full database manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection in the id_concesion parameter by validating inputs to ensure only legitimate values are processed, blocking malicious database manipulation payloads.
Requires timely remediation of the specific SQL injection flaw in Quiter Gateway versions prior to 4.7.0 through patching or upgrades to eliminate the vulnerability.
Enforces restrictions on the id_concesion parameter such as length, type, and format limits to block common SQL injection techniques like oversized or specially crafted payloads.