External risk intelligence

BEIMS Contractor Web SQL Injection Allows Sensitive Data Retrieval

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2025-10460

The vulnerability resides in a web-based portal specifically designed to facilitate contractor interaction. Such applications are commonly deployed as internet-facing services to allow external parties access to operational data, making the /BEIMSWeb/contractor.asp endpoint a likely candidate for public exposure in standard configurations.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in BEIMS Contractor Web, a legacy product no longer supported by its vendor. This issue allows unauthorized access to sensitive database information through an exposed web endpoint. Because the product is unmaintained, there will be no official fixes, and organizations must independently assess their exposure and implement compensating controls.

Unmaintained software has a critical security flaw.
Legacy systems pose ongoing, unfixable risks.
Confirm relevance; mitigate directly if exposed.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input to a public-facing web endpoint, bypassing security checks. This leads to the unauthorized retrieval of sensitive data from the product's database.

Requires internet-accessible endpoint.
Triggers via unsanitized parameter input.
Risks sensitive data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthorized user to access sensitive database contents through an unpatched, internet-facing endpoint. Such access may compromise the confidentiality, integrity, and availability of the database.

Sensitive database contents at risk.
Via unsanitized parameter input.
Compromise confidentiality, integrity, availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Because BEIMS Contractor Web is a legacy product no longer maintained by the vendor, responsibility for addressing this SQL injection vulnerability likely falls to the asset owner or IT infrastructure team. The first practical step is to identify all instances of BEIMS Contractor Web, confirm internet exposure, and then assess the business criticality to prioritize remediation efforts.

Identify and assess exposed instances.
Confirm business criticality and ownership.
Plan vendor-independent remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BEIMS Contractor Web?

BEIMS Contractor Web is a legacy software platform designed to manage and facilitate interactions between organizations and their external contractors. It provides a web-based portal to exchange operational data. Because it is a retired, unmaintained product, it no longer receives security updates or feature improvements from the vendor.

What does SQL injection mean for CVE-2025-10460?

This vulnerability is classified as Improper Input Validation (CWE-20). In simple terms, the application fails to properly clean the data it receives from users. An attacker can input malicious database commands into the system, tricking the software into executing them. This allows unauthorized users to read, modify, or potentially disrupt the information stored in the underlying database.

How is this SQL injection triggered?

The vulnerability is triggered by sending specially crafted input to the /BEIMSWeb/contractor.asp endpoint. It requires that this specific web page be accessible over the internet to allow unauthorized input. If an instance of the software is strictly limited to an internal-only network without internet connectivity, the primary path for this remote attack is blocked.

Why should I care if I run this software?

You should care because the software is no longer patched, meaning any known vulnerability remains open indefinitely. According to Halo Surface Signal, this software is often deployed specifically for external contractor access, making it a highly likely candidate for public internet exposure. If your instance is internet-facing, it is at an elevated risk of unauthorized database access.

What should I do to address this risk?

Since there are no vendor-provided patches, you must take manual action. Start by creating an inventory of all instances within your environment to confirm where they are deployed. Determine if they are accessible from the internet and evaluate their business necessity. If the system is still in use, focus on implementing compensating controls, such as restricting access via a VPN or firewall, to isolate the endpoint from the public internet.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.