CVE-2019-25431

HIGH

8.2

Beschreibung

delpino73 Blue-Smiley-Organizer 1.32 contains an SQL injection vulnerability in the datetime parameter that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through POST requests to extract sensitive data using boolean-based blind and time-based blind techniques, or write files to the server using INTO OUTFILE statements.

CVE Details

CVSS v3.1 Bewertung8.2

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht2/20/2026

Zuletzt geandert2/23/2026

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-89

Referenzen

https://github.com/delpino73/Blue-Smiley-Organizer(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/47550(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/delpino-blue-smiley-organizer-sql-injection-via-datetime(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.