Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2025-2353: VAM Virtual Airlines Manager allows attackers to inject malicious SQL
CVE-2025-2353 · published 1 year ago
Summary
A critical flaw in VAM Virtual Airlines Manager's HTTP parameter handling allows an attacker to inject malicious SQL code, potentially allowing remote access. This vulnerability was publicly disclosed and may be exploited. Users are advised to update to a fixed version as soon as possible.
Original advisory text
A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parame...
A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registry_id/plane_icao leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published17 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-2353 · NVD
Track software like this
Free during beta