CVE-2025-54946 is a critical SQL injection flaw in SUNNET Corporate Training Management System before version 10.11. Remote attackers can execute arbitrary SQL commands against the application's database. Get version 10.11 or later from SUNNET Technology, and limit who can reach the system until the upgrade is complete.
What's affected
- Product: SUNNET Corporate Training Management System, from SUNNET Technology Co., Ltd.
- Affected: versions before 10.11.
- Fixed: version 10.11 or later, per the version boundary in the record. The researcher's advisory says to contact SUNNET Technology for version updates, so ask the vendor for the current release and installation steps.
- What it allows: remote attackers can execute arbitrary SQL commands.
This is one of five related findings published together by the same researcher team (CVE-2025-54942 through CVE-2025-54946). They affect the same product and the same version range, so one upgrade addresses all of them. Plan the work as a single change.
How to check if you're exposed
This is a vendor application, so check it where it is installed.
- Find the product version in the administration pages or the installer record, and compare it with 10.11.
- Ask your SUNNET Technology contact which release you are on and whether all five advisories are covered.
- Check whether the system is reachable from the internet. A training portal often is, because staff and contractors use it from outside.
- Look at web server logs for unusual requests to deployment or upload functionality from addresses you do not recognize.
Because the vendor ships it as a packaged system, a library scan will not see it. Add it to your asset inventory with an owner and a patch contact.
What to do now
- Contact SUNNET Technology and obtain version 10.11 or later, with the vendor's upgrade instructions.
- Take a backup of the application and its database before you upgrade.
- If you cannot upgrade immediately, restrict access to the system to trusted networks or a VPN, and place a web application firewall in front of it if you have one.
- Review the server for files you did not put there, in particular in upload and deployment locations, and review logs back to the start of September 2025 at least.
- Record the upgrade and the check in your vulnerability tracker, covering all five related CVEs.
Why it matters
The weakness is SQL injection: user input becomes part of a database query instead of staying as data. A training system stores names, work emails, progress and sometimes sensitive HR details, so database access has real privacy consequences, even before you think about passwords or session data.
Defenders should use parameterized queries everywhere, give the application database account the narrowest rights it needs, and log database errors somewhere other than the browser. If you think the database was queried by someone else, review the data the system holds and check your obligations to notify people.
The researcher's advisory (ZA-2025-14) lists the mitigation as contacting the vendor for version updates, and gives no workaround. The CVE is not on the CISA KEV list.
The weakness is classed as CWE-89 (SQL Injection). Severity in the CVE record: critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Quick check
What data could be exposed?
Whatever the application's database account can read. For a training system that typically includes user names, contact details and training records.
How do I reduce the damage while I wait for the vendor?
Restrict access to trusted networks, use a least privilege database account, and review logs for unusual database errors or long queries.
Sources
Last reviewed: 18 October 2026.
