CVE-2019-25662 - Vulnerability Analysis

Overview

ResourceSpace 8.6 contains an sql injection caused by unsanitized 'ref' parameter in watched_searches.php, letting unauthenticated attackers execute arbitrary SQL queries to extract sensitive data.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL queries to extract sensitive database information including usernames and credentials.

Mitigation

Update to the latest version of ResourceSpace.

References

• https://www.exploit-db.com/exploits/46308
• https://www.resourcespace.com/
• https://www.resourcespace.com/get
• https://www.vulncheck.com/advisories/resourcespace-sql-injection-via-watched-searches-php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner