CVE-2019-25580 - Vulnerability Analysis

Overview

ownDMS 4.7 contains an sql injection caused by unsanitized IMG parameter in pdfstream.php, imagestream.php, and anyfilestream.php, letting unauthenticated attackers execute arbitrary SQL queries and extract sensitive database information.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL queries to extract sensitive database information, compromising data confidentiality.

Mitigation

Update ownDMS to the latest version.

References

• http://www.owndms.com/
• https://datapacket.dl.sourceforge.net/project/owndms/owndms_47.zip
• https://www.exploit-db.com/exploits/46168
• https://www.vulncheck.com/advisories/owndms-sql-injection-via-pdfstream-php-imagestream-php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner