Vulnerability Description
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/projectdiscovery/nuclei-templates/issues/7968
- https://web.archive.org/web/20201001011935/https://www.safeinfo.me/2019/07/22/as
- https://web.archive.org/web/20220425041152/https://asp-cms.sourceforge.net/
- https://www.ddpoc.com/DVB-2021-821.html
- https://www.vulncheck.com/advisories/asp-cms-sql-injection-via-commentlist-asp-i
- https://github.com/projectdiscovery/nuclei-templates/issues/7968
FAQ
What is CVE-2019-25765?
CVE-2019-25765 is a vulnerability with a CVSS score of 7.5 (HIGH). ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to ...
How severe is CVE-2019-25765?
CVE-2019-25765 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-25765?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.