CVE-2019-25506
Boolean-Based Blind SQL Injection in FreeSMS 2.1.2 Enables Authentication Bypass
Publication date: 2026-03-04
Last updated on: 2026-03-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freesms_project | freesms | to 2.1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2019-25506 is a boolean-based blind SQL injection vulnerability in FreeSMS version 2.1.2 that affects the password parameter on the login endpoint (/pages/crc_handler.php?method=login).'}, {'type': 'paragraph', 'content': 'This flaw allows unauthenticated attackers to inject SQL code into the password field, manipulating the SQL query logic to always evaluate as true, thereby bypassing authentication if the username is known.'}, {'type': 'paragraph', 'content': "Successful exploitation grants the attacker a valid session cookie, enabling them to log in as any known user and subsequently change that user's password via the profile update function, effectively taking over the account."}] [1, 2]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can have serious impacts as it allows attackers to bypass authentication without any credentials.'}, {'type': 'paragraph', 'content': 'Attackers can impersonate any known user, including administrators, by exploiting the SQL injection in the password parameter.'}, {'type': 'paragraph', 'content': "Once authenticated, attackers can change the compromised user's password, leading to full account takeover and unauthorized access to sensitive information and system functions."}] [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to exploit the boolean-based blind SQL injection in the password parameter on the login endpoint /pages/crc_handler.php?method=login.'}, {'type': 'paragraph', 'content': 'A typical detection method involves sending specially crafted POST requests with the username set to a known user and the password parameter containing SQL injection payloads that manipulate the SQL query logic to always evaluate as true.'}, {'type': 'paragraph', 'content': 'For example, using curl or a similar tool, you can send a POST request like:'}, {'type': 'list_item', 'content': 'curl -X POST -d "username=knownuser&password=\' OR 1=1-- " http://target/pages/crc_handler.php?method=login'}, {'type': 'paragraph', 'content': 'If the response returns a valid session cookie (named "crc"), it indicates successful authentication bypass, confirming the vulnerability.'}, {'type': 'paragraph', 'content': 'More advanced detection can be done by using the Python exploit script referenced in ExploitDB entry 46658, which automates the injection and checks for successful authentication bypass.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable login endpoint and applying input validation or parameterized queries to prevent SQL injection.
If a patch or updated version of FreeSMS is available, it should be applied promptly to fix the vulnerability.
In the absence of a patch, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the password parameter.
Additionally, monitor logs for suspicious login attempts and unauthorized password changes, and enforce strong authentication mechanisms.