CVE-2025-32847: SQL Injection Vulnerability in TeleControl Server Basic

Overview

This blog post will delve into a serious cybersecurity vulnerability identified in all versions of TeleControl Server Basic lower than V3.1.2.2. This vulnerability, designated as CVE-2025-32847, allows a potential attacker to manipulate the SQL database of the application through an SQL injection in the ‘UnlockGeneralSettings’ method.
The significance of this vulnerability is high due to the potential consequences. An attacker who successfully exploits it could bypass authorization controls, read from and write to the application’s database, and execute code with “NT AUTHORITYNetworkService” permissions. This could lead to system compromise or data leakage, putting sensitive information and system integrity at risk.

Vulnerability Summary

CVE ID: CVE-2025-32847
Severity: High (8.8 CVSS score)
Attack Vector: Network
Privileges Required: Low (Authenticated access required)
User Interaction: None
Impact: Bypass of authorization controls, potential system compromise, data leakage

Affected Products

Product | Affected Versions

TeleControl Server Basic | All versions < V3.1.2.2 How the Exploit Works

The vulnerability exists in the ‘UnlockGeneralSettings’ method internally used by the TeleControl Server Basic. This method is susceptible to SQL injection, a common technique where an attacker inserts malicious SQL code into a query. The attacker can exploit this vulnerability if they have authenticated access to the system and can reach port 8000, where the affected application is executed.
Once the malicious SQL code is injected, the attacker can manipulate the application’s database. This includes reading from and writing to the database, which could lead to unauthorized access to sensitive information, and executing code with “NT AUTHORITYNetworkService” permissions, potentially compromising the entire system.

Conceptual Example Code

The following is a conceptual representation of how an attacker might exploit this vulnerability. In this example, the attacker sends a malicious SQL command through an HTTP POST request.

POST /UnlockGeneralSettings HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "settingsKey": "'; DROP TABLE users; --" }

In this example, the attacker is attempting to delete the ‘users’ table from the database. The query will unlock the settings, and then proceed to execute the malicious SQL command due to improper input sanitization.