CVE-2019-25674 - Vulnerability Analysis

Overview

CMSsite 1.0 contains an sql_injection caused by unsanitized 'post' parameter in post.php, letting unauthenticated attackers extract sensitive database information or perform time-based blind SQL injection attacks.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database information or perform blind SQL injection, compromising data confidentiality and integrity.

Mitigation

Update to the latest version of CMSsite.

References

• https://www.exploit-db.com/exploits/46402
• https://www.vulncheck.com/advisories/cmssite-sql-injection-via-post-parameter
• https://github.com/VictorAlagwu/CMSsite

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner