vtenext: SQL injection in Fax module (CVE-2025-71456)
An SQL injection vulnerability in vtenext modules/Fax/EditView.php allows authenticated low-privileged users to extract sensitive database content, including password reset tokens.
CVE search metadata
CVE search record: CVE-2025-71456. Severity: high. CVSS: 8.1. KEV: no. Product: vtenext (< 25.02.2). Brief: vtenext: SQL injection in Fax module (CVE-2025-71456). Brief link: https://feed.craftedsignal.io/briefs/2026-11-vtenext-sqli/
Triage facts
Revision 1- Applicability
- vtenext (< 25.02.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 22:07 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
vtenext versions prior to 25.02.2 contain an SQL injection vulnerability located in the modules/Fax/EditView.php component. An authenticated, low-privileged user can exploit this by providing a crafted fieldname parameter to the affected script. Successful exploitation allows for unauthorized read access to database tables, including the vte_userauthtoken table, which may lead to account takeover via token extraction.
Impact
Successful exploitation results in unauthorized access to sensitive database information, specifically session or password reset tokens. This enables full account takeover of targeted users.
Recommendation
- Upgrade to vtenext version 25.02.2 or later immediately to remediate the vulnerability.
- Audit database access logs for unusual queries originating from the
modules/Fax/EditView.phpendpoint. - Restrict access to the
modules/Fax/EditView.phpfile to authorized administrative roles only if an immediate upgrade is not feasible.
Immediate actions
Upgrade vtenext to version 25.02.2 or later.
Threat Hunt
Hunt for HTTP GET/POST requests to modules/Fax/EditView.php containing SQL injection patterns in the fieldname parameter.
Data: Web server access logs (cs-uri-query, cs-method)
Mitigations
Apply security patch by upgrading to vtenext 25.02.2.
CVE-2025-71456