CVE-2019-25713
SQL Injection in MyT-PM 1.5.1 Allows Database Manipulation
Publication date: 2026-04-12
Last updated on: 2026-04-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| myt_project | myt | 1.5.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2019-25713 is an SQL injection vulnerability in MyT-PM version 1.5.1 and earlier. It specifically affects the Charge[group_total] parameter, allowing authenticated attackers to inject malicious SQL code.
Attackers exploit this vulnerability by sending crafted POST requests to the /charge/admin endpoint using techniques such as error-based, time-based blind, or stacked query payloads.
Successful exploitation enables attackers to execute arbitrary SQL queries, which can lead to extraction of sensitive database information or unauthorized manipulation of data.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized access to sensitive database information and manipulation of data within the MyT-PM application.
Attackers can extract confidential data or alter data integrity by exploiting the SQL injection flaw, potentially compromising the security and reliability of the affected system.
Because the attack requires authentication but has low complexity and no user interaction, it poses a significant risk to systems using MyT-PM 1.5.1 or earlier.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This SQL injection vulnerability can be detected by sending crafted POST requests to the /charge/admin endpoint targeting the Charge[group_total] parameter with specific payloads to test for SQL injection.
- Error-Based SQL Injection test payload example: Send a POST request with Charge[group_total]=1) AND EXTRACTVALUE(2003,CONCAT(0x5c,0x7171716b71,(SELECT (ELT(2003=2003,1))),0x7170707071))-- to trigger an error revealing database information.
- Time-Based Blind SQL Injection test payload example: Send a POST request with Charge[group_total]=1) AND (SELECT * FROM (SELECT(SLEEP(5)))ggBK)-- to cause a 5-second delay if vulnerable.
- Stacked Queries SQL Injection test payload example: Send a POST request with Charge[group_total]=1);SELECT SLEEP(5)# to execute multiple queries including a delay.
These tests can be performed using tools like curl or Burp Suite to craft and send the POST requests and observe the responses or delays indicating the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /charge/admin endpoint to only trusted authenticated users and monitoring for suspicious POST requests targeting the Charge[group_total] parameter.
Implement input validation and use parameterized queries or prepared statements in the application code to prevent SQL injection through the Charge[group_total] parameter.
If possible, update or patch the MyT-PM software to a version that addresses this vulnerability.
As a temporary measure, consider using a web application firewall (WAF) to block malicious payloads targeting this parameter.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in MyT-PM 1.5.1 allows attackers to extract sensitive database information or manipulate data. This exposure of sensitive data could potentially lead to non-compliance with data protection regulations such as GDPR or HIPAA, which require the protection of personal and sensitive information from unauthorized access or breaches.
Because the vulnerability enables unauthorized data access and manipulation, it poses a risk to confidentiality and integrity of data, which are key requirements in many compliance frameworks. Organizations using affected versions of MyT-PM may face compliance challenges if this vulnerability is exploited and sensitive data is compromised.