8.2high
CVE-2019-25366
microASP Portal+ CMS SQL Injection via pagina.phtml
Published 8 mo ago · modified 4 mo ago · JSON
CVSS
8.2
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 33%
Public exploits
0
none known
Summary
microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction (EPSS)
0.39% probability of exploitation in the next 30 days, higher than 33% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected products
- Microasp microASP (Portal+) CMS
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- exploit-db.com /exploits/46799 · exploit
- microasp.it / · product
- vulncheck.com /advisories/microasp-portal-cms-sql-injection-via-paginaphtml · third-party-advisory
Sources
- CVE List: CVE-2019-25366
- NVD: CVE-2019-25366
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.