提交 #595404: Qualitor Software S.A. Qualitor 8.20 and 8.24 Command Injection

Request for CVE-2025-5139 Update – Official Security Advisory from Qualitor Software

Dear VulDB Team,

I am writing on behalf of Qualitor Software regarding CVE-2025-5139.

We would like to request an update to the public information associated with this CVE to reflect our official security advisory and the resolution details we have published.

Please find below a summary of the relevant information:

Official Security Advisory – CVE-2025-5139
Publication Date: May 25, 2025
CVE Identifier: CVE-2025-5139
Affected Product(s): Qualitor – Versions 8.20 and 8.24

Summary of the Vulnerability
A command injection vulnerability was identified in the file:
/html/ad/adconexaooffice365/request/testaConexaoOffice365.php
This issue could allow an attacker to manipulate the nmconexao parameter, potentially leading to unauthorized command execution on the server. The vulnerability affects environments where Office 365-type connections are configured and is triggered during API-based account validation.

Resolution and Fix
The vulnerability has been fixed in the following versions, released on May 25, 2025:

8.20.56

8.24.31

All subsequent versions also include this fix.
The updates are available via our official support channels.

Advisory URL: https://www.qualitorsoftware.com/security/advisories/CVE-2025-5139
Vendor Contact: [email protected]

We kindly ask you to review this information and update the entry for CVE-2025-5139 accordingly. If you require any additional information or clarification, we will be glad to assist.

Thank you for your attention and support.

Best regards,
Dante Michelon
Security Team
Qualitor Software
[email protected]

• 来源: ⚠️ https://www.qualitorsoftware.com/security/advisories/CVE-2025-5139
• 用户: Dante Michelon (UID 86482)
• 提交: 2025-06-11 15時48分 (1 年前)
• 管理: 2025-06-15 13時20分 (4 days later)
• 状态: 重复
• VulDB条目: 310220 [Qualitor 8.20/8.24 Office 365-type Connection testaConexaoOffice365.php nmconexao 权限提升]
• 积分: 0