CVE-2025-40712
Published: 08 July 2025
Summary
CVE-2025-40712 is a critical-severity SQL Injection (CWE-89) vulnerability in Quiter Quiter Gateway. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-40712 is a SQL injection vulnerability (CWE-89) affecting Quiter Gateway by Quiter in versions prior to 4.7.0. The flaw exists in the id_concesion parameter within the /<Client>FacturaE/DescargarFactura endpoint, enabling arbitrary SQL operations. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to high impacts on confidentiality, integrity, and availability.
An unauthenticated attacker with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows the attacker to retrieve, create, update, or delete database contents, potentially leading to full compromise of the affected system's data.
The INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter details this among multiple vulnerabilities in Quiter products; mitigation involves upgrading to version 4.7.0 or later, where the issue is addressed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20465
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the id_concesion parameter in /<Client>FacturaE/DescargarFactura.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web endpoint directly enables unauthenticated remote exploitation of the application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validating the id_concesion parameter in the /<Client>FacturaE/DescargarFactura endpoint to ensure inputs conform to expected syntax, directly preventing SQL injection exploitation.
SI-2 mandates timely identification, reporting, and correction of flaws such as this SQL injection vulnerability through patching to version 4.7.0 or later.
SI-9 restricts information inputs to the vulnerable endpoint to only authorized types and sources, limiting the ability to inject malicious SQL payloads.