CVE-2019-25684: OpenDocMan 1.3.4 SQL Injection via where Parameter
OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25684?
The severity of CVE-2019-25684 is considered high due to the potential for unauthenticated SQL injection attacks.
How do I fix CVE-2019-25684?
To fix CVE-2019-25684, update OpenDocMan to a patched version that addresses the SQL injection vulnerability.
What vulnerability is associated with the 'where' parameter in CVE-2019-25684?
CVE-2019-25684 describes a SQL injection vulnerability that exploits the 'where' parameter in OpenDocMan search.php.
Can CVE-2019-25684 be exploited remotely?
Yes, CVE-2019-25684 can be exploited remotely by sending crafted GET requests to the affected OpenDocMan application.
What version of OpenDocMan is affected by CVE-2019-25684?
OpenDocMan version 1.3.4 is the affected version that contains the vulnerability CVE-2019-25684.