CVE-2025-34179 — NetSupport Manager < 14.12.0001 Unauthenticated SQLi Local File Disclosure
NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server evaluates request U…
Published: 2025-12-15 · CVSS: 8.7 · CVSS 4.0
NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server evaluates request URIs using an unsanitized SQLite query against the FileLinks table in gateway.db. By injecting SQL through the LinkName/URI value, a remote attacker can control the FileName field used by the server to read and return files from disk, resulting in arbitrary local file disclosure.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7