CVE-2019-25675 - Vulnerability Analysis

Overview

eDirectory contains multiple SQL injection vulnerabilities caused by unsanitized input in login and language_file.php parameters, letting unauthenticated attackers bypass admin authentication and read arbitrary PHP files.

Severity & Score

Impact

Unauthenticated attackers can bypass admin authentication and read arbitrary PHP files, leading to full system compromise.

Mitigation

Update to the latest version with patches for SQL injection vulnerabilities.

References

• https://www.edirectory.com/
• https://www.exploit-db.com/exploits/46423
• https://www.vulncheck.com/advisories/edirectory-all-versions-sql-injection-authentication-bypass

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner