CVE-2025-30062

The vulnerability resides in the validateOrgUnit function of the CheckUnitCodeAndKey.pl service. The function fails to properly neutralize special elements used in an SQL command, making it susceptible to SQL injection (CWE-89). This issue was identified and reported to CERT Polska [1].

The attack surface is likely through web requests that trigger the validateOrgUnit function. An attacker may be able to exploit this vulnerability without authentication if the service is exposed. The exact prerequisites are not detailed, but given the nature of SQL injection, any input passed to the function could be a vector.

Successful exploitation could allow an attacker to execute arbitrary SQL queries, leading to unauthorized access to or modification of data in the underlying database. This might include sensitive information such as patient records or system configurations.

As of the publication date, specific mitigation steps for this CVE are not provided in the references. However, given that similar vulnerabilities in related products have been addressed (e.g., SQL injection in CGM NETRAAD fixed in version 7.9.0 [1]), it is advisable for users to apply any available updates from the vendor or implement input validation and parameterized queries as a general security practice.