CVE-2019-25458 - Vulnerability Analysis

Overview

Web Ofisi Firma Rehberi v1 contains an sql injection caused by unsanitized GET parameters 'il', 'kat', or 'kelime', letting unauthenticated attackers extract sensitive database information or perform time-based blind SQL injection attacks.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database information or perform blind SQL injection, potentially compromising the entire database.

Mitigation

Update to the latest version with SQL injection mitigations.

References

• https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html
• https://www.exploit-db.com/exploits/47143
• https://www.vulncheck.com/advisories/web-ofisi-firma-rehberi-sql-injection-via-firmalarhtml

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner