CVE-2025-32475: SQL Injection Vulnerability in TeleControl Server Basic

Overview

The cybersecurity field is no stranger to software vulnerabilities, and the recently discovered CVE-2025-32475 is no exception. This vulnerability affects all versions of TeleControl Server Basic before V3.1.2.2. The software is susceptible to SQL injection attacks, a common but dangerous type of security breach that can allow unauthorized access to sensitive data. This vulnerability is significant due to the potential for system compromise or data leakage, making any system running a vulnerable version of the software a potential target.

Vulnerability Summary

CVE ID: CVE-2025-32475
Severity: High (8.8 CVSS Score)
Attack Vector: Network (Port 8000)
Privileges Required: Authenticated access
User Interaction: None
Impact: Authorization bypass, data read/write access, and code execution with “NT AUTHORITYNetworkService” permissions.

Affected Products

Product | Affected Versions

TeleControl Server Basic | All versions < V3.1.2.2 How the Exploit Works

The vulnerability lies within the ‘UpdateProject’ method of the TeleControl Server Basic application. An attacker, given authenticated access and network connectivity to the target system, can inject malicious SQL commands through this method. This allows the attacker to bypass authorization controls and interact with the application’s database. This interaction may include reading, writing, or manipulating data, and even executing code with “NT AUTHORITY\NetworkService” permissions.

Conceptual Example Code

This is a conceptual example of how an attacker might exploit the vulnerability using a SQL injection attack:

POST /UpdateProject HTTP/1.1
Host: target.example.com:8000
Content-Type: application/sql
{ "project_update": "' OR '1'='1'; DROP TABLE users; --" }

In the above example, the attacker is injecting a SQL command (‘ OR ‘1’=’1′; DROP TABLE users; –) into the project_update field. This command is designed to bypass authorization controls (the ‘ OR ‘1’=’1′ part always evaluates to true) and then deletes the users table from the database.
Remember, this is a conceptual example. The actual payload will vary depending on the database structure and the attacker’s objectives.