CVE-2025-55343
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via multiple parameters in various PHP files, including busqueda/busqueda.php, anexos_lista.php, Administracion/listas/*.php, asociar_documentos/*.php, radicacion/*.php, reportes/reporte_TraspasoDocFisico.php, tx/*.php, and uploadFiles/cargar_doc_digitalizado_paginador.php.
Risk Assessment
An attacker could read, modify, or delete database data, and in some cases execute system commands, compromising data confidentiality and integrity.
Recommendation
Update Quipux to a version containing fixes (later than e1774ac) or apply security patches. Enforce least privilege for user accounts.
Other vulnerabilities in Quipux
See all- CVE-2025-55342Medium
Quipux 4.0.1 through e1774ac allows enumeration of usernames and access to the Ecuadorian identification number for all registered users via the txt_login parameter in Administracion/usuarios/cambiar_password_olvido_validar.php.
- CVE-2025-55341Medium
A Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac affects anexos/anexos_nuevo.php via the asocImgRad parameter. The vulnerability allows injection of malicious script that may execute in the user's browser.
Original NVD description (English source)
Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt_depe_codi, busqueda/busqueda.php txt_usua_codi, anexos_lista.php radi_temp, Administracion/listas/formArea_ajax.php codDepe, Administracion/listas/formDepeHijo_ajax.php codDepe, Administracion/listas/formDepePadre_ajax.php codInst, asociar_documentos/asociar_borrar_referencia.php radi_nume, asociar_documentos/asociar_documento_buscar_query.php radi_nume, asociar_documentos/asociar_documento_grabar.php txt_radi_nume, asociar_documentos/asociar_documento radi_nume, radicacion/buscar_usuario.php buscar_tipo, radicacion/formArea_ajax.php codDepe, radicacion/formDepeHijo_ajax.php codDepe, radicacion/formDepePadre_ajax.php codInst, radicacion/ver_datos_usuario.php destinatorio, reportes/reporte_TraspasoDocFisico.php verrad, tx/datos_imprimir_sobre.php txt_usua_codi, tx/datos_imprimir_sobre.php nume_radi_temp, tx/revertir_firma_digital_grabar.php txt_radi_nume, tx/tx_borrar_opcion_imp.php codigo_opc, tx/tx_realizar_tx.php txt_radicados, tx/tx_seguridad_documentos.php txt_radicados, or uploadFiles/cargar_doc_digitalizado_paginador.php txt_depe_codi.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS