CVE-2025-40617 is a critical SQL injection flaw (CVSS 9.8) in Bookgy. Three parameters in the file /bkg_seleccionar_hora_ajax.php reach the database unsafely and allow reading and changing data. The record names no fixed version, so read the INCIBE notice and ask the vendor for a patch.
What's affected
The record names Bookgy, with no version number. The vulnerable file is /bkg_seleccionar_hora_ajax.php, and the parameters named are IDTIPO, IDPISTA and IDSOCIO. The record does not describe what the application does beyond its name.
The record says an attacker could retrieve, create, update and delete databases by sending an HTTP request. The CVSS vector shows network access, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
The record points to a notice from INCIBE-CERT, the Spanish national cybersecurity institute, titled "Multiple vulnerabilities in Bookgy". I could not read it, because the site rejected my request. The record lists no affected or fixed versions, so check the notice for them, and contact the vendor.
How to check if you're exposed
- Find out whether you run Bookgy, or whether a club or supplier hosts it for you. If it is hosted for you, ask them about this CVE.
- Check whether the file bkg_seleccionar_hora_ajax.php is reachable on your instance.
- Look at web server logs for requests to that file, and for requests that include the three parameter names, from sources you do not know.
- Check the database logs for errors that came from malformed queries.
grep -c "bkg_seleccionar_hora_ajax.php" /var/log/apache2/access.log
Adjust the log path for your server. The count tells you how often the file is called, so compare it with normal use.
What to do now
- Contact the vendor and read the INCIBE notice to find the fixed release. Apply it when you have it.
- Until then, restrict access to the application, for example to the networks your members use, or put it behind a gateway with a web application firewall as a stopgap.
- If you maintain the code, change the affected queries to prepared statements for IDTIPO, IDPISTA and IDSOCIO, and check the other parameters in the same file.
- Run the database account with the minimum privileges. The record says databases can be created and deleted, so the account should not be allowed to do that.
- Take a fresh backup, and review logs for past misuse. If you see signs, rotate credentials and tell the people whose data is held.
Why it matters
The weakness is SQL injection, CWE-89. The three parameters reach a database query without being kept apart from the SQL text. Whoever controls those values can change what the query does, and the record says that can include reading and rewriting data.
The score of 9.8 comes from the combination of no login, simple requests and full impact. Any system that stores member or customer records holds personal data, so the stakes are real.
This CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not claim that it is exploited. The record lists no vendor patch, which makes access control and monitoring more important. Our free in-browser dependency scan checks the libraries your code uses, but this flaw sits in the application's own code. A DAST scan, as in the demo below, tests a running site from the outside.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Bookgy version is fixed?
The record does not say. Read the INCIBE notice and ask the vendor for the fixed release, and restrict access until you have it.
Sources
The INCIBE page refused my request, so the details above come from the CVE record.
Last reviewed: 18 October 2026.
