CVE-2025-40622
📋 TL;DR
This is a critical SQL injection vulnerability in TCMAN's GIM v11 software that allows unauthenticated attackers to execute arbitrary SQL commands through the 'username' parameter of the 'GetLastDatePasswordChange' endpoint. Attackers can read, modify, or delete all database information. All organizations using TCMAN GIM v11 are affected.
💻 Affected Systems
- TCMAN GIM
📦 What is this software?
Gim by Tcman
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of all sensitive data, credential harvesting, data destruction, and potential lateral movement to other systems.
Likely Case
Data exfiltration of user credentials, personal information, and business data leading to privacy violations and operational disruption.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing database access.
🎯 Exploit Status
SQL injection via HTTP parameters is well-understood with many available tools. Unauthenticated access makes exploitation trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in advisory
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcmans-gim
Restart Required: No
Instructions:
1. Contact TCMAN vendor for patch availability 2. Monitor vendor website for security updates 3. Apply patch when available following vendor instructions
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests
Input Validation
allImplement strict input validation on 'username' parameter to reject SQL special characters
🧯 If You Can't Patch
- Isolate GIM system from internet and restrict internal network access
- Implement database firewall rules to limit query types and block suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Test 'GetLastDatePasswordChange' endpoint with SQL injection payloads in username parameterCheck Version:
Check GIM administration interface or configuration files for version informationVerify Fix Applied:
Verify parameterized queries are implemented and input validation rejects SQL special characters📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web application
- Multiple failed login attempts with SQL syntax
- Database error messages in application logs
Network Indicators:
- HTTP requests to GetLastDatePasswordChange with SQL keywords in parameters
- Unusual database traffic patterns
SIEM Query:
source="web_logs" AND uri="*GetLastDatePasswordChange*" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*1=1*")