CVE-2019-25643 - Vulnerability Analysis

Overview

eNdonesia Portal v8.7 contains an SQL injection caused by improper sanitization of the bid parameter in banners.php, letting unauthenticated attackers execute arbitrary SQL queries and extract sensitive database information.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL queries, leading to sensitive data disclosure and potential full database compromise.

Mitigation

Update to the latest version of eNdonesia Portal that addresses SQL injection vulnerabilities.

References

• http://www.endonesia.org/
• https://sourceforge.net/projects/endonesia/
• https://www.exploit-db.com/exploits/46559
• https://www.vulncheck.com/advisories/endonesia-portal-sql-injection-via-banners-php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner