CVE-2019-25459 - Vulnerability Analysis

Overview

Web Ofisi Emlak V2 contains multiple sql injection vulnerabilities caused by unsanitized GET parameters including emlak_durumu, emlak_tipi, il, ilce, kelime, and semt, letting unauthenticated attackers extract sensitive database information or perform time-based blind SQL injection attacks.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database information or perform time-based blind SQL injection attacks, potentially compromising the entire database.

Mitigation

Update to the latest version with SQL injection protections or apply input sanitization and parameterized queries.

References

• https://www.exploit-db.com/exploits/47142
• https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-emlak-arahtml
• https://www.web-ofisi.com/detay/emlak-scripti-v3.html

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner