CVE-2019-25505: Tradebox 5.4 SQL Injection via symbol Parameter
Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the symbol parameter. Attackers can send POST requests to the monthlydeposit endpoint with malicious symbol values using boolean-based blind, time-based blind, error-based, or union-based SQL injection techniques to extract sensitive database information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25505?
CVE-2019-25505 is classified as a critical vulnerability due to the potential for SQL injection leading to unauthorized access and data manipulation.
How do I fix CVE-2019-25505?
To fix CVE-2019-25505, ensure your application properly sanitizes user inputs and avoid using unprepared SQL statements.
Who is affected by CVE-2019-25505?
CVE-2019-25505 affects authenticated users of Tradebox 5.4 who can send requests to the monthly_deposit endpoint.
What kind of attack is possible with CVE-2019-25505?
CVE-2019-25505 allows authenticated attackers to execute arbitrary SQL code through the symbol parameter, leading to potential data breaches.
Is there a workaround for CVE-2019-25505?
A possible workaround for CVE-2019-25505 includes implementing application-level access controls to limit user permissions.