Vulnerability Description
ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extract sensitive database information including version and database names.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Owndms | Owndms | <= 4.7 |
Related Weaknesses (CWE)
References
- http://www.owndms.com/Broken Link
- https://datapacket.dl.sourceforge.net/project/owndms/owndms_47.zipBroken Link
- https://www.exploit-db.com/exploits/46168ExploitVDB Entry
- https://www.vulncheck.com/advisories/owndms-sql-injection-via-pdfstream-php-imagThird Party Advisory
FAQ
What is CVE-2019-25580?
CVE-2019-25580 is a vulnerability with a CVSS score of 8.2 (HIGH). ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET ...
How severe is CVE-2019-25580?
CVE-2019-25580 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-25580?
Check the references section above for vendor advisories and patch information. Affected products include: Owndms Owndms.