Summary
SicommNet BASEC is an online eProcurement solution used by governments and other entities. Multiple vulnerabilities have been found in BASEC. These vulnerabilities allow a remote, unauthenticated attacker to gain administrative privileges, read user passwords, and obtain credentials. The attacker could take complete control of BASEC and all of the user data stored in BASEC.
Vulnerabilities 3
-
Critical 9.3
SQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at…
-
Critical 9.3
Insecure password storage in SicommNet BASEC
Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easi…
-
High 8.7
XSS, HTML and Style injection on login page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML and alternation of CSS Styles This issue aff…
Revision history
-
#2.0.0
Updated status for CVE-2025-22371
-
#1.0.0
Initial publication