Strix
26.1K

CVE-2025-66260

HIGHCVSS 7.2/10EPSS 0.27%

Last modified

CVE-2025-66260 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in status_sql.php. The `status_sql.php` endpoint constructs SQL UPDATE queries by directly concatenating user-controlled `sw1` and `sw2` parameters without using parameterized queries or `pg_escape_string()`. EPSS estimates a 0.27% chance of exploitation in the next 30 days.

Description

PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in status_sql.php. The `status_sql.php` endpoint constructs SQL UPDATE queries by directly concatenating user-controlled `sw1` and `sw2` parameters without using parameterized queries or `pg_escape_string()`. While PostgreSQL's `pg_exec` limitations prevent stacked queries, attackers can inject subqueries for data exfiltration and leverage verbose error messages for reconnaissance.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS 4.0
7.2/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.27%

18.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
DbbroadcastMozart Next 100 FirmwareAll versions
DbbroadcastMozart Next 1000 FirmwareAll versions
DbbroadcastMozart Next 2000 FirmwareAll versions
DbbroadcastMozart Next 30 FirmwareAll versions
DbbroadcastMozart Next 300 FirmwareAll versions
DbbroadcastMozart Next 3000 FirmwareAll versions
DbbroadcastMozart Next 3500 FirmwareAll versions
DbbroadcastMozart Next 50 FirmwareAll versions
DbbroadcastMozart Next 500 FirmwareAll versions
DbbroadcastMozart Next 6000 FirmwareAll versions
DbbroadcastMozart Next 7000 FirmwareAll versions
DbbroadcastMozart Dds Next 30 FirmwareAll versions
DbbroadcastMozart Dds Next 50 FirmwareAll versions
DbbroadcastMozart Dds Next 100 FirmwareAll versions
DbbroadcastMozart Dds Next 300 FirmwareAll versions
DbbroadcastMozart Dds Next 500 FirmwareAll versions
DbbroadcastMozart Dds Next 1000 FirmwareAll versions
DbbroadcastMozart Dds Next 2000 FirmwareAll versions
DbbroadcastMozart Dds Next 3000 FirmwareAll versions
DbbroadcastMozart Dds Next 3500 FirmwareAll versions
DbbroadcastMozart Dds Next 6000 FirmwareAll versions
DbbroadcastMozart Dds Next 7000 FirmwareAll versions

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-66260?
PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in status_sql.php. The `status_sql.php` endpoint constructs SQL UPDATE queries by directly concatenating user-controlled `sw1` and `sw2` parameters without using parameterized queries or `pg_escape_string()`. While PostgreSQL's `pg_exec` limitations prevent stacked queries, attackers can inject subqueries for data exfiltration and leverage verbose error messages for reconnaissance.
How severe is CVE-2025-66260?
CVE-2025-66260 has a CVSS score of 7.2/10 (HIGH severity). The EPSS model estimates a 0.27% probability of exploitation in the next 30 days.
How do I fix CVE-2025-66260?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-66260?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST