CVE-2025-26852
📋 TL;DR
DESCOR INFOCAD versions 3.5.1 and earlier contain a SQL injection vulnerability that allows attackers to execute arbitrary SQL commands on the database. This affects all users running vulnerable versions of the INFOCAD software. The vulnerability is fixed in version 3.5.2.0.
💻 Affected Systems
- DESCOR INFOCAD
📦 What is this software?
Infocad by Descor
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution on the database server.
Likely Case
Unauthorized data access, data exfiltration, and potential application-level authentication bypass.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
SQL injection vulnerabilities typically have low exploitation complexity, especially when unauthenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.2.0
Vendor Advisory: https://www.infocadfm.com/changelog/sql-injection/
Restart Required: Yes
Instructions:
1. Download INFOCAD version 3.5.2.0 from the vendor website. 2. Backup current installation and database. 3. Run the installer to upgrade to version 3.5.2.0. 4. Restart the INFOCAD service and verify functionality.
🔧 Temporary Workarounds
Implement WAF Rules
allDeploy web application firewall rules to block SQL injection patterns.
Database Permission Restrictions
allLimit database user permissions to only necessary operations.
🧯 If You Can't Patch
- Isolate the INFOCAD system from untrusted networks.
- Implement strict network segmentation and monitor all database queries.
🔍 How to Verify
Check if Vulnerable:
Check INFOCAD version in application settings or About dialog. If version is 3.5.1 or earlier, the system is vulnerable.Check Version:
Check application version through INFOCAD interface or registry key: HKEY_LOCAL_MACHINE\SOFTWARE\DESCOR\INFOCAD\VersionVerify Fix Applied:
Verify version shows 3.5.2.0 or higher in application settings.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts followed by complex queries
- SQL syntax errors in application logs
Network Indicators:
- Unusual database connection patterns
- SQL keywords in HTTP parameters
- Excessive database requests from single source
SIEM Query:
source="database_logs" AND (sql="SELECT" OR sql="UNION" OR sql="OR 1=1") AND NOT user="authorized_user"