CVE-2019-25642 - Vulnerability Analysis

Overview

Bootstrapy CMS contains multiple sql injection vulnerabilities caused by unsanitized POST parameters (thread_id, subject, post-id) in various scripts, letting unauthenticated attackers execute arbitrary SQL queries and extract sensitive data or cause denial of service.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL queries, leading to data disclosure or denial of service.

Mitigation

Update Bootstrapy CMS to the latest version with SQL injection fixes.

References

• http://bootstrapy.com
• https://www.exploit-db.com/exploits/46590
• https://www.vulncheck.com/advisories/bootstrapy-cms-lastest-multiple-sql-injection-via-forum-and-contact-modules

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner