CVE-2019-25676 - Vulnerability Analysis

Overview

Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities caused by unsanitized URL parameters in categorysearch.php and list-details.php, letting unauthenticated attackers execute arbitrary code or extract database information.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary scripts or extract database information, leading to data theft or site compromise.

Mitigation

Update to the latest version of Ask Expert Script that addresses these vulnerabilities.

References

• https://www.exploit-db.com/exploits/46426
• https://www.vulncheck.com/advisories/ask-expert-script-cross-site-scripting-sql-injection
• http://www.phpscriptsmall.com/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner