SAT CFDI 3.3 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id' parameter in th…

CVE-2018-25202 affects SAT CFDI 3.3, a tax compliance system, containing a critical SQL injection vulnerability in the signIn endpoint. Attackers can exploit the 'id' parameter through POST requests using boolean-based blind, stacked queries, or time-based blind SQL injection techniques. This vulnerability allows manipulation of database queries to extract sensitive data or compromise the application. Multiple proof-of-concept exploits are available, indicating active threat potential. The vulnerability represents a significant risk to organizations using this tax compliance system.