Description
A vulnerability has been found in Engeman Web up to 12.0.0.2. The affected element is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of Cookie leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 12.0.0.3 is sufficient to fix this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Engeman | Web | 12.0.0.0, 12.0.0.1, 12.0.0.2 | 12.0.0.3 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
m3m0o/engeman-web-language-combobox-sqli ★ 3 · Jul 27, 2025
Proof of concept for exploitation of the vulnerability described in CVE-2025-8220, which concerns the possibility of SQL Injection during the password recovery page load in the Engeman Web software.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- VDB-317808 | Engeman Web Password Recovery RecoveryPass sql injection vdb-entry technical-description
- VDB-317808 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #616747 | Engeman Engeman Web <= 12.0.0.1 SQL Injection third-party-advisory
- https://github.com/m3m0o/engeman-web-language-combobox-sqli exploit