CVE-2019-25346
BaseFortify
Publication date: 2026-02-12
Last updated on: 2026-03-02
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kostasmitroglou | password_management_application | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "The vulnerability is a SQL injection in TheSystem 1.0 application, specifically in the 'server_name' parameter of a POST request to the /data/ endpoint."}, {'type': 'paragraph', 'content': "Attackers can manipulate this parameter by injecting malicious SQL code such as ' or '1=1, which allows them to bypass authentication mechanisms."}, {'type': 'paragraph', 'content': 'This happens because the application does not enforce proper login checks (login_required is not used), enabling unauthorized users to access database information.'}] [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass authentication and gain unauthorized access to sensitive database records.
As a result, attackers may retrieve confidential system information, potentially leading to data breaches or further exploitation of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This SQL injection vulnerability can be detected by sending a specially crafted POST request to the /data/ endpoint with the 'server_name' parameter containing SQL injection payloads such as ' or '1=1."}, {'type': 'paragraph', 'content': "For example, you can use curl to test the vulnerability by sending a multipart/form-data POST request with the 'server_name' parameter set to a SQL injection string."}, {'type': 'list_item', 'content': 'curl -X POST http://target-system/data/ -F "server_name=\' or \'1=1"'}, {'type': 'paragraph', 'content': 'If the response includes database entries or unauthorized data, it indicates the presence of the vulnerability.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
I don't know