CVE-2025-14598

BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://afnaan.me/cve/cve-2025-14598	Third Party Advisory
https://cloudilyaerp.com/	Product
https://github.com/Afnaan-Ahmed/CVE-2025-14598	Exploit Third Party Advisory
https://www.kb.cert.org/vuls/id/361400	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cloudilyaerp:bet_e-portal:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-09 13:15

Updated : 2026-06-17 08:36

NVD link : CVE-2025-14598

Mitre link : CVE-2025-14598

CVE.ORG link : CVE-2025-14598

JSON object : View

Products Affected

cloudilyaerp

bet_e-portal

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-14598", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14598", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-09T15:46:39.443257Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "BeeS Software Solutions", "product": "BET ePortal", "versions": [{"status": "affected", "version": "0", "lessThan": "ePortal : Secure Build (October 2025)", "versionType": "custom"}]}]}], "published": "2026-01-09T13:15:54.990", "references": [{"url": "https://afnaan.me/cve/cve-2025-14598", "tags": ["Third Party Advisory"], "source": "cret@cert.org"}, {"url": "https://cloudilyaerp.com/", "tags": ["Product"], "source": "cret@cert.org"}, {"url": "https://github.com/Afnaan-Ahmed/CVE-2025-14598", "tags": ["Exploit", "Third Party Advisory"], "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/361400", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database."}, {"lang": "es", "value": "BeeS Software Solutions BET Portal contiene una vulnerabilidad de inyecci\u00f3n SQL en la funcionalidad de inicio de sesi\u00f3n de los sitios afectados. La vulnerabilidad permite la ejecuci\u00f3n de comandos SQL arbitrarios en la base de datos de backend."}], "lastModified": "2026-06-17T08:36:14.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cloudilyaerp:bet_e-portal:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41BBFEF4-9BC1-4E71-8E91-BF57CCE249D2"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}