CVE-2019-25538 - Vulnerability Analysis

Overview

202CMS v10 beta contains an sql_injection caused by unsanitized input in the log_user parameter, letting unauthenticated attackers extract or modify database contents remotely, exploit requires crafted requests.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive data or modify database contents, potentially compromising the entire database.

Mitigation

Update to the latest version of 202CMS.

References

• https://sourceforge.net/projects/b202cms/
• https://www.exploit-db.com/exploits/46579
• https://www.vulncheck.com/advisories/202cms-v10-beta-sql-injection-via-log-user-parameter

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner