CVE-2025-2113 is a high severity SQL injection flaw (CVSS 7.3) in AT Software Solutions ATSVD up to version 3.4.1. The password recovery form, labelled Esqueceu a senha, passes the txtCPF field into a database query unsafely. The record says upgrading to version 3.4.2 addresses it.
What's affected
- Product: AT Software Solutions ATSVD
- Affected versions: up to and including 3.4.1
- Fixed version: 3.4.2, per the record
- Vulnerable component: the password recovery form (Esqueceu a senha), argument
txtCPF - CVSS: 7.3 (High), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Published: 2025-03-09
The vector shows no privileges and no user interaction are needed, because a password recovery page is reachable before anyone logs in. The record says the exploit has been disclosed to the public. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation.
How to check if you're exposed
ATSVD is a vendor application, so there may be no package manager entry. Check the installed version through the application's own about or admin screen, or ask the vendor how your deployment reports it.
- Find the version number. Anything at or below 3.4.1 is affected.
- Work out whether the password recovery page is reachable from the internet. If it is, exposure is the highest.
- Look at web server logs for the recovery page and compare request volume and content with normal use. A cluster of requests with quote characters or SQL keywords in the form field is worth escalating.
- Run a free in-browser dependency scan on any web project you maintain around the product, to catch known issues in its libraries.
If you cannot tell which version you run, assume the worst and ask the vendor in writing.
What to do now
- Confirm the ATSVD version in each environment, including test copies.
- Upgrade to 3.4.2 or later following the vendor's instructions, and keep a backup of the database before you do.
- Until the upgrade lands, restrict the password recovery page with a network allowlist or a web application firewall rule.
- Review recent recovery requests and any unexpected password resets or account changes since March 2025.
- If anything looks wrong, reset affected credentials and tell the people whose data may have been read.
Why it matters
The weakness is CWE-89, SQL injection, filed with its parent class CWE-74. The recovery form takes a CPF, a Brazilian taxpayer number, and uses it to look up an account. When that value is joined into a query as text, a crafted value changes the query instead of identifying a person.
Recovery forms are an attractive target because they sit outside the login wall and talk to the same database as everything else. The fixed release matters more than a filter in front of the form. A vendor release number is also a very clear thing to track, which makes this an easy item for an inventory to carry.
Quick check
Is there a fixed version?
Yes. The record says upgrading to version 3.4.2 addresses the issue, so aim for that or later.
Does this need a login?
No. The vector lists no privileges required, and the affected form is the password recovery page.
Sources
Last reviewed: 19 October 2026.
