The Buroweb platform version 2505.0.12 contains a SQL injection flaw in the ‘tablon’ component. Unsanitized parameters in the endpoint /sta/CarpetaPublic/doEvent?APP_CODE=STA&PAGE_CODE=TABLON allow an attacker to embed arbitrary SQL statements. Exploiting this vulnerability could allow an adversary to execute queries on the database and gain access to confidential information.

The affected product is T‑Systems Buroweb, specifically the 2505.0.12 release. It has been fixed in 2505.0.13 and any later stable release according to the vendor’s advisory.

The CVSS score of 9.3 classifies the vulnerability as Critical. However, the EPSS score is listed as < 1 %, indicating that exploitation attempts are currently rare at the industry level. The vulnerability is not included in CISA’s KEV catalog, suggesting no known widespread exploitation yet. Based on the description, the likely attack vector is remote HTTP requests to the vulnerable endpoint, and the flaw does not appear to require authentication, which widens its attack surface.