← Retour aux CVEs
CVE-2019-25366
HIGH8.2
Description
microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.
Details CVE
Score CVSS v3.18.2
SeveriteHIGH
Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Vecteur d'attaqueNETWORK
ComplexiteLOW
Privileges requisNONE
Interaction utilisateurNONE
Publie2/22/2026
Derniere modification2/23/2026
Sourcenvd
Observations honeypot0
Faiblesses (CWE)
CWE-89
References
http://www.microasp.it/(disclosure@vulncheck.com)
https://www.exploit-db.com/exploits/46799(disclosure@vulncheck.com)
https://www.vulncheck.com/advisories/microasp-portal-cms-sql-injection-via-paginaphtml(disclosure@vulncheck.com)
Correlations IOC
Aucune correlation enregistree
This product uses data from the NVD API but is not endorsed or certified by the NVD.