CVE-2019-25580

EUVD-2019-19903
ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extract sensitive database information including version and database names.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
Affected Products (NVD)
VendorProductVersion
owndmsowndms
𝑥
≤ 4.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.owndms.com/
https://datapacket.dl.sourceforge.net/project/owndms/owndms_47.zip
https://www.exploit-db.com/exploits/46168
https://www.vulncheck.com/advisories/owndms-sql-injection-via-pdfstream-php-imagestream-php