CVE-2019-25298
Multiple SQL Injection Vulnerabilities in html5_snmp
Publication date: 2026-02-06
Last updated on: 2026-03-02
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lolypop55 | html5_snmp | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in html5_snmp version 1.11 and involves multiple SQL injection flaws in the Router_ID (POST) and Router_IP (GET) parameters.
Attackers can exploit these flaws using various SQL injection techniques such as error-based, boolean-based blind, time-based blind, and UNION-based injections to manipulate database queries.
These techniques allow attackers to extract or modify sensitive information from the MySQL database by sending specially crafted payloads that exploit weaknesses in how the application handles input parameters.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized access to sensitive database information.
Attackers can extract confidential data, manipulate database contents, and potentially execute arbitrary commands on the server.
Such exploitation could lead to data breaches, loss of data integrity, and even remote code execution or shell access, compromising the entire system hosting the application.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the Router_ID (POST) and Router_IP (GET) parameters of the html5_snmp 1.11 application for SQL injection weaknesses.'}, {'type': 'list_item', 'content': 'For Router_ID (POST) parameter, use error-based SQL injection payloads that exploit MySQL error messages, such as injecting subqueries with CONCAT and FLOOR(RAND(0)*2) to trigger database errors.'}, {'type': 'list_item', 'content': "Use time-based blind SQL injection techniques by injecting payloads with MySQL's SLEEP() function to observe delays in response times, confirming injection points without error messages."}, {'type': 'list_item', 'content': 'For Router_IP (GET) parameter, test with boolean-based blind SQL injection payloads using logical conditions (e.g., AND 3390=3390) to infer true/false responses.'}, {'type': 'list_item', 'content': 'Use UNION-based SQL injection payloads by injecting UNION ALL SELECT statements with crafted data to extract database information.'}, {'type': 'paragraph', 'content': 'Example commands include sending crafted HTTP requests to get_router_show.php with manipulated Router_IP or Router_ID parameters containing the above payloads to observe database behavior and confirm vulnerabilities.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
I don't know