Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-29529 — SQLi ITC Multiplan v3.7.4.1002 (CVE-2025-29529) | Kitploit
Tools/GitHubGitHub/yoshik0xf6/cve-2025-29529
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingDatabase Security
GitHubyoshik0xf6/cve-2025-29529

CVE-2025-29529

SQLi ITC Multiplan v3.7.4.1002 (CVE-2025-29529)

View Repository
1 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

SQLi ITC Multiplan (CVE-2025-29529)

Discovery

On February 21, 2025, an SQL injection vulnerability was identified in the “Multiplan” platform developed by ITC Systems during a client engagement.

Affected Versions

This vulnerability has been only been tested on v3.7.4.1002 screenshot

Attack Vector

The "ctl00%24cpLogin%24ctlForgotPassword%24txtEmail" POST parameter used by the "ForgotPassword.aspx" endpoint was found to be not sanitized. An unauthenticated threat actor may leverage this vulnerability to read the applications backend database. screenshot

POC

As a Proof-of-Concept (PoC), database information such as tables and columns were collected. screenshot screenshot

Vulnerability Check

Copy and paste a BurpSuite POST request from the /ForgotPassword.aspx endpoint to a text file.

  • Leverage sqlmap (sqlmap -r burprequest.txt -p ctl00%24cpLogin%24ctlForgotPassword%24txtEmail)

Remediation

Update platform to ITC's current offering by contacting ITC Sales to discuss upgrade path to netZcore on-premise or netZcore Avro, ITC's advanced OneCard Cloud service.

References

https://itcsystems.com/end-of-service-life-eosl-notice-multiplan-matrix-onecard-platform/

Download Tool