CVE-2025-25181: Advantive VeraCore SQL injection in timeoutWarning.asp

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is an unauthenticated, network-reachable SQL injection listed in CISA KEV with very high EPSS, indicating active exploitation.

What it is

VeraCore through 2025.1.0 contains a SQL injection flaw in timeoutWarning.asp reachable through the PmSess1 parameter. A remote, unauthenticated attacker can inject arbitrary SQL commands, and the issue is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being exploited in the wild.

Impact

An attacker can execute arbitrary SQL against the VeraCore database, exposing or altering stored data. The CVSS vector rates only confidentiality impact as high, so integrity and availability effects are not established by the record.

Attack surface

The vector is network reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), so the endpoint can be hit directly over HTTP. No authentication is required per the CVSS vector.

Exploitation

CISA added it to KEV on 2025-03-10 with a remediation due date of 2025-03-31, and EPSS gives a 30-day probability of 0.57031 (99th percentile). Reference tags include Exploit and Technical Description, and the KEV entry does not list known ransomware use.

What to do

• Apply the vendor fix or mitigation from Advantive support knowledge base for VeraCore; if no fix is available, follow CISA KEV guidance and discontinue use of the product.
• Restrict network access to timeoutWarning.asp and the VeraCore web tier to trusted networks or VPN until patched.
• Deploy WAF rules blocking SQL injection patterns on the PmSess1 parameter and related endpoints.
• Rotate database and application credentials that may have been exposed, and review database accounts for least privilege.
• Monitor for exploitation attempts and treat any confirmed hit as a database compromise.

Detection

• Search web logs for requests to timeoutWarning.asp with suspicious or SQL-like values in the PmSess1 parameter.
• Alert on SQL error strings or unexpected database errors returned by VeraCore endpoints.
• Baseline and monitor database queries and outbound connections from the VeraCore host for anomalous activity.
• Review authentication and session logs for unauthenticated access to timeoutWarning.asp.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.