Integratec application: SQL injection via sInfo parameter in login
Summary
The Integratec application, a talent and human resources management platform, contains a UNION-based SQL injection in the sInfo POST parameter of /login/ap_Login.aspx/start. An attacker who can reach this endpoint over the network can send crafted requests without credentials or user interaction, which may allow theft of stored data such as credentials and user information, partial denial of service and follow-up attacks such as privilege escalation. The CNA lists all versions as affected and no vendor patch was available at publication.
Affected
- Integratec application, all versions according to the CNA record (no version-specific data published)
- Affected component: endpoint /login/ap_Login.aspx/start, parameter sInfo (POST)
Fixed in
Unknown. No solution reported at time of publication; contact Integratec for a patched build.
Workaround
- Restrict access to the application to users, networks and channels that strictly need it
- Keep the application off the public internet (VPN or IP allow-listing)
- Place a web application firewall in front of the endpoint as a temporary measure
- Review database account privileges used by the application
Exploitation
- No confirmed exploitation in the wild found; INCIBE reports no confirmed incidents or active campaigns
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total
- Not listed in KEV; VulDB reports no exploit available
Our recommendation
- Check whether the Integratec application is deployed or reachable in your organisation, including SaaS and self-hosted use
- Ask Integratec for the patched version and an advisory, and apply it as soon as available
- Remove direct internet exposure of the login page now
- Review logs for anomalous POST requests to /login/ap_Login.aspx/start
- If the application holds personnel data, assess data protection obligations under the Swiss nDSG in case of a breach
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice (English) www.incibe.es
- INCIBE-CERT notice (Spanish) www.incibe.es
- OpenCVE CVE-2026-13695 app.opencve.io
- VulDB entry 422294 vuldb.com
- CVE record mirror (threatint) cve.threatint.com
- Techconsulting advisory summary techconsulting.es
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:53.
Original description (NVD)
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.