CVE-2025-34179

Description

NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server evaluates request URIs using an unsanitized SQLite query against the FileLinks table in gateway.db. By injecting SQL through the LinkName/URI value, a remote attacker can control the FileName field used by the server to read and return files from disk, resulting in arbitrary local file disclosure.

Traduire en français

Produits concernés

• NetSupport Software Manager

Scores CVSS

Faiblesses (CWE)

• CWE-89

Références

• https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager/
• https://ret2.me/post/2025-12-04-exploiting-netsupport-gateway/
• https://www.vulncheck.com/advisories/netsupport-manager-unauthenticated-sqli-local-file-disclosure

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories