CVE-2018-25171 - Vulnerability Analysis

Overview

EdTv 2 contains an sql injection caused by unsanitized 'id' parameter in admin/edit_source endpoint, letting unauthenticated attackers execute arbitrary SQL queries and extract database information, exploit requires crafted GET requests.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL queries to extract sensitive database information, compromising data confidentiality and integrity.

Mitigation

Update to the latest version with SQL injection fixes.

References

• https://www.exploit-db.com/exploits/45849
• https://www.vulncheck.com/advisories/edtv-sql-injection-via-id-parameter

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner