CVE-2025-10460 in Contractor Web
Summary
by MITRE • 11/17/2025
A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input validation on /BEIMSWeb/contractor.asp endpoint and successful exploitation requires a contractor.asp endpoint open to the internet. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity and potentially the availability of the database.
Version 5.7.139
has been confirmed as vulnerable. Other versions have not been confirmed by the vendor and users should assume that all versions of BEIMS Contractor Web may be impacted until further guidance is provided by the vendor.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/18/2025
The CVE-2025-10460 vulnerability represents a critical SQL injection flaw in BEIMS Contractor Web version 5.7.139 and potentially all other versions of this legacy software. This vulnerability exists within the contractor.asp endpoint which serves as a web interface for contractor management operations. The software operates in an environment where the contractor.asp endpoint is exposed to internet traffic, creating an attack surface that malicious actors can exploit without authentication. This exposure is particularly concerning given that BEIMS Contractor Web is a legacy product that has ceased vendor maintenance and patching efforts, leaving organizations with no official remediation path for this vulnerability.
The technical exploitation of this vulnerability stems from inadequate input validation mechanisms within the /BEIMSWeb/contractor.asp endpoint. When user-supplied parameters are processed through this interface, they are not properly sanitized or escaped before being incorporated into SQL query constructs. This allows attackers to inject malicious SQL code that gets executed within the database context. The vulnerability manifests as a classic SQL injection attack vector where an attacker can manipulate the input fields to alter the intended database query behavior. According to CWE-89, this vulnerability maps directly to the CWE-89 category of SQL injection flaws, which are among the most prevalent and dangerous web application vulnerabilities. The attack requires no special privileges or authentication as the endpoint is internet-facing, making it accessible to any attacker who can reach the web server.
The operational impact of this vulnerability extends beyond simple data theft, encompassing full database compromise with potential for data manipulation and service disruption. An attacker who successfully exploits this vulnerability can extract sensitive contractor information, personal identification details, financial records, and potentially other organizational data stored within the database. The confidentiality, integrity, and availability of the entire database system are at risk, as demonstrated by the vulnerability's ability to execute arbitrary SQL commands. This type of compromise aligns with ATT&CK technique T1071.004 for application layer protocol usage and T1566.001 for credential access through social engineering, though in this case the attack vector is direct exploitation rather than social engineering. The database integrity may be compromised through data modification or deletion operations, while the availability could be impacted through denial-of-service attacks or data corruption.
Organizations utilizing BEIMS Contractor Web must implement immediate mitigations given the lack of vendor support for this vulnerability. Network segmentation should be implemented to restrict access to the contractor.asp endpoint, limiting exposure to trusted internal networks only. Web application firewalls should be deployed to monitor and filter incoming requests to the vulnerable endpoint, though this is not a permanent solution due to the legacy nature of the software. Input validation should be implemented at the application level to sanitize all user-supplied parameters before database processing occurs. However, the most effective long-term mitigation involves complete software replacement or migration to supported alternatives, as the vendor has ceased maintenance and patching activities. The vulnerability's persistence across all versions indicates a fundamental architectural flaw that cannot be resolved through simple updates or patches, making the software essentially unusable in production environments without significant security risk mitigation measures.