« Volver al listado

CVE-2025-7714

Estado: ModificadaCrítica (9.8)—

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows Command Line Execution through SQL Injection.

This issue affects Content Management System (CMS): through 21072025.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

SQL injection (CWE-89) en CMS accesible por red sin autenticación (AV:N/PR:N) permite inyectar comandos; CVSS crítico (C:H/I:H/A:H) confirma ejecución de código, lectura y manipulación de datos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentRestrict File and Directory PermissionsRemote Data StorageNetwork Segmentation

Tecnologías afectadas (1)

Globalmedya — Content Management System

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-7714",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-7714",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-29T15:54:22.056330Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "iletisim@usom.gov.tr",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "iletisim@usom.gov.tr",
      "affectedData": [
        {
          "vendor": "Global Interactive Design Media Software Inc.",
          "product": "Content Management System (CMS)",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "21072025"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-29T15:16:12.330",
  "references": [
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0008",
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://www.usom.gov.tr/bildirim/tr-26-0008",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "iletisim@usom.gov.tr"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "iletisim@usom.gov.tr",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows Command Line Execution through SQL Injection.\n\nThis issue affects Content Management System (CMS): through 21072025."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando SQL (inyección SQL) en el Sistema de Gestión de Contenidos (CMS) de Global Interactive Design Media Software Inc. permite la ejecución de comandos de línea a través de inyección SQL. Este problema afecta al Sistema de Gestión de Contenidos (CMS): hasta el 21072025."
    }
  ],
  "lastModified": "2026-06-17T10:05:30.950",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:globalmedya:content_management_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2418FBF9-B5F0-4051-A7C8-90D65EED3113",
              "versionEndIncluding": "2025-07-21"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "iletisim@usom.gov.tr"
}