CVE-2025-32842: SQL Injection Vulnerability in TeleControl Server Basic

Overview

A significant cybersecurity vulnerability, CVE-2025-32842, has been discovered in TeleControl Server Basic, affecting all versions prior to V3.1.2.2. This vulnerability is a SQL injection vulnerability in the ‘GetUsers’ method, which could allow an attacker to manipulate the application’s database and even execute code with “NT AUTHORITY\NetworkService” permissions.
This vulnerability presents a significant threat to any organization utilizing the affected versions of TeleControl Server Basic, as it could lead to potential system compromise or data leakage. In the wrong hands, this vulnerability could result in unauthorized access to sensitive information, disruption of services, and potential loss of control over critical infrastructure.

Vulnerability Summary

CVE ID: CVE-2025-32842
Severity: High (CVSS: 8.8)
Attack Vector: Network
Privileges Required: User level
User Interaction: Required
Impact: System compromise, potential data leakage

Affected Products

Product | Affected Versions

TeleControl Server Basic | All versions < V3.1.2.2 How the Exploit Works

The vulnerability arises from the insecure implementation of the ‘GetUsers’ method within TeleControl Server Basic. This method is vulnerable to SQL injection, a common attack technique that involves inserting malicious SQL code into a query. An attacker, once authenticated, can exploit this vulnerability by sending specially crafted requests to the server via port 8000, manipulating the SQL query to bypass authorization controls.
This allows them to read from and write to the application’s database, potentially accessing sensitive data or modifying the application’s behavior. Furthermore, the attacker can execute code with “NT AUTHORITYNetworkService” permissions, an account that has more privileges than a standard authenticated user, increasing the potential harm of the attack.

Conceptual Example Code

Below is a simple, conceptual example of how the vulnerability might be exploited. This example represents a malicious payload sent to the vulnerable endpoint:

POST /getUsers HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "userID": "1; DROP TABLE users;--" }

In this example, the `userID` payload includes a SQL command (`DROP TABLE users`) after a semicolon. If the server does not properly sanitize the input, it would execute this command, deleting the entire ‘users’ table from the database.