CVE-2025-41013 – This SQL injection vulnerability in TCMAN GIM v... (How to Fix)

Q: What is the severity of CVE-2025-41013?

CVE-2025-41013 has a CVSS score of 9.8 (CRITICAL). This SQL injection vulnerability in TCMAN GIM v11 allows attackers to manipulate database queries through the 'idmant' parameter in GET requests to '/PC/frmEPIS.aspx'. Attackers can retrieve, modify, create, or delete database content. Organizations using TCMAN GIM v11 version 20250304 are affected.

📋 TL;DR

This SQL injection vulnerability in TCMAN GIM v11 allows attackers to manipulate database queries through the 'idmant' parameter in GET requests to '/PC/frmEPIS.aspx'. Attackers can retrieve, modify, create, or delete database content. Organizations using TCMAN GIM v11 version 20250304 are affected.

💻 Affected Systems

Products:

TCMAN GIM

Versions: v11 version 20250304

Operating Systems: Windows, Linux

Default Config Vulnerable: ⚠️ Yes

Notes: All installations with the vulnerable version are affected regardless of configuration.

📦 What is this software?

Gim by Tcman

View all CVEs affecting Gim →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including data theft, data destruction, and potential system takeover via subsequent attacks.

🟠

Likely Case

Unauthorized data access and modification leading to data integrity loss and potential business disruption.

🟢

If Mitigated

Limited impact with proper input validation and database permissions restricting damage scope.

🌐 Internet-Facing: HIGH - The vulnerable endpoint is accessible via web requests, making internet-facing instances immediately vulnerable.

🏢 Internal Only: HIGH - Even internal systems are vulnerable to insider threats or compromised internal accounts.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

SQL injection via GET parameter requires minimal technical skill to exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-2

Restart Required: No

Instructions:

1. Monitor vendor for patch release. 2. Apply patch when available. 3. Test in non-production environment first.

🔧 Temporary Workarounds

Web Application Firewall (WAF)

all

Deploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint.

Input Validation Filter

all

Implement server-side validation to sanitize 'idmant' parameter before processing.

🧯 If You Can't Patch

Block external access to '/PC/frmEPIS.aspx' at network perimeter.
Implement strict database user permissions with least privilege principle.

🔍 How to Verify

Check if Vulnerable:

Test the endpoint with SQL injection payloads in the 'idmant' parameter and observe database errors or unexpected responses.

Check Version:

Check application version in admin interface or configuration files.

Verify Fix Applied:

Retest with SQL injection payloads after applying fixes; successful attacks should be blocked.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL error messages in application logs
Multiple requests to '/PC/frmEPIS.aspx' with suspicious 'idmant' values

Network Indicators:

GET requests to '/PC/frmEPIS.aspx' containing SQL keywords in parameters

SIEM Query:

source="web_logs" AND uri="/PC/frmEPIS.aspx" AND (param="idmant" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR 1=1")

📊 Metadata

CVE ID: CVE-2025-41013

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

EPSS Score: 0.05% exploit probability (13.7th percentile)

Published: December 2, 2025

Last Updated: December 3, 2025

🔗 References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-2 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-41013, you might also want to check these: