CVE-2019-25709 - Vulnerability Analysis

Overview

CF Image Hosting Script 1.6.5 contains an information disclosure caused by unauthenticated access to imgdb.db file in upload/data directory, letting attackers download and decode the database, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can download and decode the database, extract delete IDs, and delete all pictures.

Mitigation

Update to the latest version or apply patches to restrict access to the database file.

References

• https://www.exploit-db.com/exploits/46094
• https://www.vulncheck.com/advisories/cf-image-hosting-script-unauthorized-database-access
• http://forum.codefuture.co.uk/showthread.php?tid=73141
• https://davidtavarez.github.io/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner