CVE-2025-41013
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.
Risk Assessment
An attacker can take control of the database, exfiltrate or destroy data, and potentially access other system resources. High risk to data confidentiality, integrity, and availability.
Recommendation
Update TCMAN GIM to a patched version or implement filtering of the 'idmant' parameter and use parameterized queries. Restrict access to '/PC/frmEPIS.aspx' to trusted networks.
Other vulnerabilities in TCMAN GIM
See all- CVE-2025-41015High
User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetUserQuestionAndAnswer' in '/WS/PDAWebService.asmx'.
- CVE-2025-41014High
User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in '/WS/PDAWebService.asmx'.
Original NVD description (English source)
SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS