CVE-2025-5697: Brilliance Golden Link Secondary System tcCustDeferPosiQuery.htm sql injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-05 · updated 2026-06-17
Weakness: CWE-74

Description

A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424. This issue affects some unknown processing of the file /reprotframework/tcCustDeferPosiQuery.htm. The manipulation of the argument custTradeId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

Brilliance Golden Link Secondary System: through 2025-04-24

References

https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E9%BB%84%E9%87%91%E9%80%9Astorageworkrent-tcCustDeferPosiQuery.md
https://vuldb.com/?ctiid.311213
https://vuldb.com/?id.311213
https://vuldb.com/?submit.588323

Get alerted when CVE-2025-5697 or the next vulnerability affects your stack