CVE-2025-41018 is a critical SQL injection (CVSS 9.8) in Sergestec Exito v8.0. The cat parameter of /public.php lets an attacker read and change the database. INCIBE reported no fix at the time of publication, so limit exposure and ask the vendor for a patched release.
What's affected
The CVE record names Sergestec Exito v8.0, and the weak input is the cat parameter of the page /public.php. The public in the name matters: that page is meant to be reachable by site visitors, so it is not tucked behind an admin login.
INCIBE coordinated four related vulnerabilities across Sergestec products. Besides this one, it lists CVE-2025-41019, a SQL injection in SISTICK v7.2, CVE-2025-41020, an insecure direct object reference in Exito, and CVE-2025-41021, a stored cross-site scripting issue in Exito.
On the fix, the INCIBE notice says no solution had been reported when it was written. I could not confirm a fixed version, so check with Sergestec directly.
How to check if you're exposed
Start with the version. If you run Exito, confirm that you are on v8.0 or an earlier release, using the product admin screen or your deployment records. Also check whether SISTICK v7.2 is in your estate, because it has a sibling flaw.
Then look at your web server access logs for requests to /public.php with an unusually long or odd cat value. Repeated database errors on that page are another warning sign. Logs cannot prove you are safe, but they can show you are being probed.
Check whether the application is internet facing. If it is, that is where to start containment.
What to do now
- Identify every Exito and SISTICK installation and its version.
- Contact Sergestec for a fixed release, and ask for a date.
- Put a web application firewall rule or reverse proxy filter in front of the app while you wait, and limit who can reach it.
- Reduce the database account used by the application to the minimum rights it needs.
- Take and test a backup now, and review logs for the affected pages.
Why it matters
CWE-89 is the textbook injection flaw. The page takes a value from the request and uses it to build a database query. If the value is not kept separate from the query logic, the attacker decides part of the query. The record says this allows retrieving, creating, updating and deleting databases.
No customer exposure is reported here, and the CVE is not on the CISA Known Exploited Vulnerabilities list. Where a vendor has no patch, the useful controls sit around the product: network limits, a least privilege database account and good backups.
Quick check
Is there a patch for CVE-2025-41018?
INCIBE said no solution had been reported when it published. I could not confirm a fix, so contact Sergestec before assuming one exists.
What else should I check if I run Sergestec software?
Look at SISTICK v7.2 for CVE-2025-41019 and at Exito for CVE-2025-41020 and CVE-2025-41021. All four were announced together.
Sources
Last reviewed: 18 October 2026.
