CVE-2025-29980 CRITICAL

CVE-2025-29980: Blind SQL Injection vulnerability in eTRAKiT.Net

Vendor Centralsquare

Product eTRAKiT.Net

Weakness CWE-89 · SQLi

Published March 20, 2025

Last update April 7, 2025

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.77. eTRAKiT.Net is no longer supported, and users are recommended to migrate to the latest version of CentralSquare Community Development.

Key dates

02Disclosure timeline

March 20, 2025 CVE published

April 7, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-29980 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

CVE-2025-29980: Blind SQL Injection vulnerability in eTRAKiT.Net

01Description

02Disclosure timeline

03References

04Related CVE