SicommNet BASEC SQL Injection Vulnerability Allowing Authentication Bypass

A SQL injection vulnerability has been identified in the SicommNet BASEC SaaS service login page. This vulnerability allows an unauthenticated remote attacker to bypass authentication and execute arbitrary SQL commands. It affects BASEC versions from December 14, 2021, to April 16, 2025.

Impact

Exploitation of this vulnerability allows for authentication bypass and execution of arbitrary SQL commands, potentially leading to unauthorized access or manipulation of the application's database.

Remediation

SicommNet has fixed this vulnerability as of April 16, 2025. However, users are advised to consider all data in the BASEC tool compromised and to stop using the service.