CVE-2019-25456 - Vulnerability Analysis

Overview

Web Ofisi Emlak v2 contains an sql injection caused by unsanitized 'ara' GET parameter, letting unauthenticated attackers extract sensitive data or cause denial of service via time-based payloads.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive data or cause denial of service by exploiting SQL injection.

Mitigation

Update to the latest version of Web Ofisi Emlak.

References

• https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-ara-parameter
• https://www.web-ofisi.com/detay/emlak-scripti-v2.html
• https://www.exploit-db.com/exploits/47141

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner