CVE-2025-56385

{
  "id": "CVE-2025-56385",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-12T19:15:36.323",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to authentication bypass, data leakage, or full system compromise of backend database contents."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL existe en la funcionalidad de inicio de sesión de WellSky Harmony versión 4.1.0.2.83 dentro del endpoint ’xmHarmony.asp’. La entrada proporcionada por el usuario al parámetro ’TXTUSERID’ no se sanea adecuadamente antes de ser incorporada en una consulta SQL. La autenticación exitosa puede conducir a una omisión de autenticación, fuga de datos o compromiso total del sistema de los contenidos de la base de datos de backend."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-13T15:05:24.976620Z",
          "id": "CVE-2025-56385",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wellsky:harmony:4.1.0.2.83:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C37B93C-FDC9-4519-A575-ADF98EC9300E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://machevalia.blog/blog/cve-2025-56385-wellsky-harmony-sql-injection",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}