CVE-2019-25494 - Vulnerability Analysis

Overview

Homey BNB V4 contains an sql injection caused by injection of SQL syntax into username and password fields in the administration panel login, letting unauthenticated attackers bypass authentication and gain admin access, exploit requires crafted input in login fields.

Severity & Score

Impact

Unauthenticated attackers can bypass authentication and gain unauthorized admin panel access.

Mitigation

Update to the latest version with SQL injection fixes.

References

• https://www.doditsolutions.com/airbnb-clone-script/
• https://www.exploit-db.com/exploits/46616
• https://www.vulncheck.com/advisories/homey-bnb-sql-injection-authentication-bypass-via-admin-panel

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner