CVE-2025-10460

A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input validation on /BEIMSWeb/contractor.asp endpoint and successful exploitation requires a contractor.asp endpoint open to the internet. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity and potentially the availability of the database. Version 5.7.139 has been confirmed as vulnerable. Other versions have not been confirmed by the vendor and users should assume that all versions of BEIMS Contractor Web may be impacted until further guidance is provided by the vendor.

CVSS

No CVSS.

References

Link	Resource
https://help.fmiworks.com/knowledge/beims-web
https://help.fmiworks.com/knowledge/contractor-web-operational-requirements

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección SQL en un endpoint en BEIMS Contractor Web, un producto heredado que ya no es mantenido ni parcheado por el proveedor, permite a un usuario no autorizado recuperar contenido sensible de la base de datos a través de la entrada de parámetros no saneada. Esta vulnerabilidad ocurre debido a una validación de entrada incorrecta en el endpoint /BEIMSWeb/contractor.asp y la explotación exitosa requiere un endpoint contractor.asp abierto a internet. Esta vulnerabilidad permite a los atacantes ejecutar comandos SQL arbitrarios, comprometiendo la confidencialidad, integridad y potencialmente la disponibilidad de la base de datos. La versión 5.7.139 ha sido confirmada como vulnerable. Otras versiones no han sido confirmadas por el proveedor y los usuarios deben asumir que todas las versiones de BEIMS Contractor Web pueden verse afectadas hasta que el proveedor proporcione más orientación.

Information

Published : 2025-11-17 03:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-10460

Mitre link : CVE-2025-10460

CVE.ORG link : CVE-2025-10460

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-10460", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10460", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-17T16:42:03.168458Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "affectedData": [{"vendor": "BEIMS", "product": "Contractor Web", "versions": [{"status": "affected", "version": "5.7"}], "defaultStatus": "affected"}]}], "published": "2025-11-17T03:15:55.170", "references": [{"url": "https://help.fmiworks.com/knowledge/beims-web", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}, {"url": "https://help.fmiworks.com/knowledge/contractor-web-operational-requirements", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor,\u00a0allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input validation on /BEIMSWeb/contractor.asp endpoint and successful exploitation requires a contractor.asp endpoint open to the internet. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity and potentially the availability of the database.\u00a0\n\n\n\n\n\nVersion 5.7.139\n\n\u00a0has been confirmed as vulnerable. Other versions have not been confirmed by the vendor and users should assume that all versions of BEIMS Contractor Web may be impacted until further guidance is provided by the vendor."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL en un endpoint en BEIMS Contractor Web, un producto heredado que ya no es mantenido ni parcheado por el proveedor, permite a un usuario no autorizado recuperar contenido sensible de la base de datos a trav\u00e9s de la entrada de par\u00e1metros no saneada. Esta vulnerabilidad ocurre debido a una validaci\u00f3n de entrada incorrecta en el endpoint /BEIMSWeb/contractor.asp y la explotaci\u00f3n exitosa requiere un endpoint contractor.asp abierto a internet. Esta vulnerabilidad permite a los atacantes ejecutar comandos SQL arbitrarios, comprometiendo la confidencialidad, integridad y potencialmente la disponibilidad de la base de datos.\n\nLa versi\u00f3n 5.7.139 ha sido confirmada como vulnerable. Otras versiones no han sido confirmadas por el proveedor y los usuarios deben asumir que todas las versiones de BEIMS Contractor Web pueden verse afectadas hasta que el proveedor proporcione m\u00e1s orientaci\u00f3n."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}