CVE-2019-25539 - Vulnerability Analysis

Overview

202CMS v10 beta contains a blind SQL injection caused by unsanitized input in the log_user parameter in index.php, letting unauthenticated attackers extract sensitive database information via time-based blind injection.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database information, potentially compromising data confidentiality.

Mitigation

Update to the latest version of 202CMS to address this vulnerability.

References

• https://sourceforge.net/projects/b202cms/
• https://www.exploit-db.com/exploits/46579
• https://www.vulncheck.com/advisories/202cms-v10-beta-sql-injection-via-register-php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner