CVE-2025-40677

> 文章来源: The Hacker News

> 抓取时间: 202605040654

> 原文 ID: article_290

> 生成时间: 2026-05-05 14:18

基础信息

字段值 CVECVE-2025-40677 CVSS 估计9.0+ 漏洞类型sql_injection, command_injection 受影响组件Summar Employee Portal 3.98.0

漏洞摘要

[webapps] Summar Employee Portal 3.98.0 - Authenticated SQL Injection

根因分析

sql_injection, command_injection

攻击向量

详见原文

PoC / 关键代码

# Google Dork: inurl:"/MemberPages/quienesquien.aspx"
# Date: 09/22/2025
# Exploit Author: Peter Gabaldon - https://pgj11.com/
# Vendor Homepage: https://www.summar.es/
# Software Link: https://www.summar.es/software-recursos-humanos/
# Version: < 3.98.0
# Tested on: Kali
# CVE: CVE-2025-40677
# Des

修复建议

参考官方补丁或安全公告

Semgrep 检测 Hint

- id: auto-hint-cve_2025_40677
  pattern: 'cursor.execute(... + $INPUT)'
  message: "Potential sql_injection - 参考 CVE-2025-40677"
  severity: WARNING
  languages: [python]

标签

sql_injection, command_injection

*由 vuln_card_gen.py 自动生成，来源: The Hacker News*

🤖 漏洞情报系统自动分析生成 · 2026-07-02