CVE-2019-25576 - Vulnerability Analysis

Overview

Kepler Wallpaper Script 1.1 contains an sql injection caused by unsanitized input in the category parameter, letting unauthenticated attackers execute arbitrary SQL queries and extract database information, exploit requires crafted GET requests.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL queries to extract sensitive database information.

Mitigation

Update to the latest version.

References

• https://keplerwallpapers.online/
• https://www.exploit-db.com/exploits/46207
• https://www.vulncheck.com/advisories/kepler-wallpaper-script-sql-injection-via-category
• https://codeclerks.com/PHP/1559/Kepler-Wallpaper-Script

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner