External risk intelligence

DIAL CentrosNet SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-10870

The vulnerability exists in a PHP-based web application component designed to handle login requests via standard POST and GET methods. Because this component is part of a web application interface commonly accessed over the internet for user authentication and management, it presents an externally reachable attack surface.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical SQL injection vulnerability found in DIAL's CentrosNet technology, which could allow unauthorized access and modification of your databases through standard web requests. The main concern is confirming if this technology is in use and if it is exposed externally.

It's a database access flaw.
Leadership should remember its potential for data compromise.
Confirm relevance and external exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the CentrosNet login page from anywhere on the internet. By manipulating the 'ultralogin' parameter in specific web requests, they can interact with the vulnerable PHP script. This interaction could allow them to gain unauthorized control over the application's databases.

No authentication needed to start.
Triggered by sending specially crafted web requests.
Risk of unauthorized database access and modification.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability could allow an unauthenticated attacker to impact database operations, including reading, creating, updating, and deleting data. This is possible when an attacker sends specially crafted POST or GET requests to the 'ultralogin.php' endpoint.

Database integrity and confidentiality.
Unauthenticated SQL injection via web requests.
Unauthorized database modification or access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in DIAL's CentrosNet could allow unauthorized database manipulation. Technical leaders should prioritize identifying all instances of this software, determining their network exposure and business criticality, and then assigning ownership for remediation. Coordination with the vendor may be necessary.

Application owners and infrastructure teams
Confirm external reachability and critical systems
Plan vendor-coordinated remediation

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DIAL CentrosNet?

DIAL CentrosNet is a web-based application used for managing data and user interactions. It relies on PHP scripts and backend databases to process information, serving as an interface for administrative or user-facing tasks. Organizations typically deploy it to streamline database-driven workflows.

What does SQL injection mean for CVE-2025-10870?

This CVE involves CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. Simply put, the application does not properly validate data input. An attacker can supply malicious database commands through the software, tricking it into executing those commands against the backend database rather than just processing the intended input.

How is the vulnerability in centrosnet/ultralogin.php triggered?

An attacker triggers the flaw by sending a specifically crafted GET or POST request containing a manipulated 'ultralogin' parameter to the vulnerable PHP script. No special conditions are required; it does not trigger if the application is not actively receiving these web requests or if the parameter is not present.

Do I need to worry about my network exposure?

Yes, if you run this software. According to Halo Surface Signal, this component handles web-based authentication and is often placed on the internet, creating an externally reachable attack surface. If your instance is accessible from the outside, it is a primary concern because the flaw does not require valid login credentials to exploit.

When should I address this CVE-2025-10870 vulnerability?

Prioritize this immediately by identifying every server running CentrosNet. Once mapped, confirm whether these instances are reachable over the internet. Work with your infrastructure teams to assess the business impact of these systems and coordinate directly with the vendor for the necessary remediation steps to secure your database access.

References

www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-dials-cent…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.