CVE-2019-25506

Katalog CVE

CVSS 9.8 · Critical EPSS 0,46%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada freesms project freesms. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

FreeSMS 2.1.2 contains a boolean-based blind SQL injection vulnerability in the password parameter that allows unauthenticated attackers to bypass authentication by injecting SQL code through the login endpoint. Attackers can exploit the vulnerable password parameter in requests to /pages/crc_handler.php?method=login to authenticate as any known user and subsequently modify their password via the profile update function.

Rincian

Terbit di NVD

4 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/freesms-authentication-bypass-via-sql-injection advisory pihak ketiga
• https://www.exploit-db.com/exploits/46658 exploit · vdb entry