CVE-2019-25703: ImpressCMS 1.3.11 SQL Injection via bid Parameter
ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'bid' parameter. Attackers can send POST requests to the admin.php endpoint with malicious 'bid' values containing SQL commands to extract sensitive database information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25703?
CVE-2019-25703 is classified as a high severity vulnerability due to its potential for SQL injection exploitation.
How do I fix CVE-2019-25703?
To fix CVE-2019-25703, it is recommended to update ImpressCMS to a patched version that addresses this SQL injection vulnerability.
What type of attack does CVE-2019-25703 facilitate?
CVE-2019-25703 facilitates time-based blind SQL injection attacks that can compromise the database.
Who is affected by CVE-2019-25703?
CVE-2019-25703 affects users of ImpressCMS version 1.3.11 who have access to the admin.php endpoint.
Can CVE-2019-25703 be exploited remotely?
Yes, CVE-2019-25703 can be exploited remotely by authenticated attackers through crafted POST requests.