CVE-2025-40985: SCATI Vision Web SQLi Vulnerability

CVE-2025-40985 Overview

CVE-2025-40985 is a SQL injection vulnerability [CWE-89] affecting SCATI Vision Web from SCATI Labs, versions 4.8 through 7.2. The flaw resides in the login parameter of the /scatevision_web/index.php/loginForm endpoint. An unauthenticated remote attacker can inject SQL syntax through this parameter to exfiltrate data from the backend database. The Spanish National Cybersecurity Institute (INCIBE) published an advisory documenting the issue.

Critical Impact
Unauthenticated attackers can extract sensitive data from the SCATI Vision Web database by injecting SQL payloads into the login form, exposing credentials and video surveillance metadata.

Affected Products

SCATI Vision Web 4.8 through 7.2 (SCATI Labs)
/scatevision_web/index.php/loginForm endpoint
Backend database used by SCATI Vision Web

Discovery Timeline

2025-07-16 - CVE-2025-40985 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-40985

Vulnerability Analysis

The vulnerability is a classic SQL injection in the authentication interface of SCATI Vision Web. The login parameter submitted to /scatevision_web/index.php/loginForm is concatenated into a database query without proper parameterization or input sanitization. An attacker can craft payloads that alter the SQL statement to return data outside the original query scope.

Because the endpoint is the login form, no prior authentication is required. The attack is network-reachable wherever the SCATI Vision Web interface is exposed. Exploitation primarily targets data confidentiality, allowing extraction of database contents including authentication records and surveillance-related metadata.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The application builds login queries by concatenating user-supplied input rather than using prepared statements or bound parameters. Any SQL metacharacters supplied in the login parameter are interpreted as part of the query.

Attack Vector

The attacker sends an HTTP POST request to the /scatevision_web/index.php/loginForm endpoint with a malicious value in the login field. Typical payloads use boolean-based, time-based, or UNION-based techniques to enumerate database structures and extract rows. No user interaction or privileges are required. Refer to the INCIBE Security Notice: SQL Injection for the official advisory.

Detection Methods for CVE-2025-40985

Indicators of Compromise

HTTP POST requests to /scatevision_web/index.php/loginForm containing SQL metacharacters such as ', ", --, ;, UNION, SELECT, or SLEEP( in the login parameter.
Repeated failed login attempts originating from a single source against the SCATI Vision Web login endpoint.
Unusually large HTTP response sizes or response times from the loginForm endpoint indicating data extraction or time-based injection.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the login POST parameter for SQL injection patterns and block requests matching known payloads.
Enable database query logging and alert on syntactically anomalous queries originating from the SCATI Vision Web application user.
Correlate web server access logs with database audit logs to identify injection attempts followed by unexpected SELECT activity against authentication tables.

Monitoring Recommendations

Forward web server, application, and database logs from SCATI Vision Web hosts to a central SIEM for correlation and retention.
Baseline normal login traffic volume and alert on spikes or off-hours access to the loginForm endpoint.
Monitor outbound network traffic from the SCATI Vision Web server for unusual data egress that could indicate database exfiltration.

How to Mitigate CVE-2025-40985

Immediate Actions Required

Identify all SCATI Vision Web deployments between versions 4.8 and 7.2 and prioritize remediation, especially internet-facing instances.
Restrict access to /scatevision_web/index.php/loginForm to trusted networks using firewall or reverse proxy access control lists.
Contact SCATI Labs to obtain the patched version and apply it as soon as it is available.
Rotate credentials stored in the SCATI Vision Web database under the assumption they may have been exposed.

Patch Information

SCATI Labs is the vendor responsible for issuing fixed builds. At the time of NVD publication, the INCIBE Security Notice is the authoritative reference for the vulnerability and the vendor's remediation status. Administrators should follow the advisory and upgrade to a version higher than 7.2 once SCATI Labs publishes a fixed release.

Workarounds

Place SCATI Vision Web behind a WAF configured with SQL injection signatures that inspect POST body parameters, including login.
Limit network exposure of the management interface by binding it to internal networks or VPN-only access.
Enforce least-privilege database accounts so the application user cannot read tables outside the minimum required for authentication.

bash

# Example WAF rule (ModSecurity) to block SQLi in the login parameter
SecRule REQUEST_URI "@beginsWith /scatevision_web/index.php/loginForm" \
    "phase:2,chain,deny,status:403,id:1040985,\
     msg:'CVE-2025-40985 SQLi attempt on SCATI Vision Web login'"
    SecRule ARGS:login "@detectSQLi" "t:none"