CVE-2025-40728 SQL injection vulnerability in Customer Support System

High 8.7 Published 16 Jun 2025 Updated 16 Jun 2025

An authenticated attacker can manipulate the id parameter to read, create, update, or delete database records in the Customer Support System.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-40728?

CVE-2025-40728 is a high-severity SQL injection vulnerability in Customer Support System, published on 16 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databases via the id parameter in the /customer_support/manage_user.php endpoint.

Weakness: CWE-89

Which versions are affected by CVE-2025-40728?

It affects 1 product.

Products include Oretnom23 Customer Support System.

How do I fix CVE-2025-40728?

No fix has been published for CVE-2025-40728 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-40728 being exploited?

There is no known exploitation of CVE-2025-40728 in the wild and no public exploit code.

Sources

Also known as GHSA-jh8r-584f-349g.