CVE-2019-25486 - Vulnerability Analysis

Overview

Varient 1.6.1 contains an sql injection caused by unsanitized user_id parameter in POST requests, letting unauthenticated attackers bypass authentication and extract sensitive database information.

Severity & Score

Impact

Unauthenticated attackers can bypass authentication and extract sensitive database information.

Mitigation

Update to the latest version.

References

• https://varient.codingest.com/
• https://www.exploit-db.com/exploits/47058
• https://www.vulncheck.com/advisories/varient-sql-injection-via-user-id-parameter

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner