CVE-2019-25513 - Vulnerability Analysis

Overview

Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an sql injection caused by unsanitized 'q' parameter in datagetir.php, letting unauthenticated attackers extract sensitive data or bypass authentication via time-based blind SQL injection.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database information or bypass authentication, compromising data confidentiality and system access.

Mitigation

Update to the latest version of Jettweb PHP Hazir Haber Sitesi Scripti or apply patches that sanitize SQL inputs.

References

• https://www.exploit-db.com/exploits/46599
• https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-sql-injection-via-datagetir-php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner