8.2high
CVE-2019-25504
NCrypted Jobgator Lastest SQL Injection via agents Find-Jobs
Published 8 mo ago · modified 4 mo ago · JSON
CVSS
8.2
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 19%
Public exploits
0
none known
Summary
NCrypted Jobgator contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the experience parameter. Attackers can send POST requests to the agents Find-Jobs endpoint with malicious experience values to extract sensitive database information.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction (EPSS)
0.27% probability of exploitation in the next 30 days, higher than 19% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected products
- Ncrypted NCrypted Jobgator
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- exploit-db.com /exploits/46663 · exploit
- vulncheck.com /advisories/ncrypted-jobgator-lastest-sql-injection-via-agents-find-jobs · third-party-advisory
Sources
- CVE List: CVE-2019-25504
- NVD: CVE-2019-25504
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.