CVE-2019-25713
CVE-2019-25713
7.1
HighPublished:
Last updated:
Source:disclosure@vulncheck.com
Analyzed
Weakness (CWE)
CVSS Vector
v4.0- Attack Vector
- Network
- Attack Complexity
- Low
- Attack Requirements
- None
- Privileges Required
- Low
- User Interaction
- None
- Confidentiality (Vulnerable)
- High
- Integrity (Vulnerable)
- Low
- Availability (Vulnerable)
- None
- Confidentiality (Subsequent)
- None
- Integrity (Subsequent)
- None
- Availability (Subsequent)
- None
Description
MyT-PM 1.5.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the Charge[group_total] parameter. Attackers can submit crafted POST requests to the /charge/admin endpoint with error-based, time-based blind, or stacked query payloads to extract sensitive database information or manipulate data.
References
disclosure@vulncheck.com
https://manageyourteam.net/disclosure@vulncheck.com
https://sourceforge.net/projects/myt/disclosure@vulncheck.com
https://www.exploit-db.com/exploits/46084disclosure@vulncheck.com
https://www.vulncheck.com/advisories/myt-pm-sql-injection-via-charge-group-total-parameter