CVE-2019-25675— eDirectory SQL注入漏洞

eDirectory All Versions SQL Injection Authentication Bypass

eDirectory contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to bypass administrator authentication and disclose sensitive files by injecting SQL code into parameters. Attackers can exploit the key parameter in the login endpoint with union-based SQL injection to authenticate as administrator, then leverage authenticated file disclosure vulnerabilities in language_file.php to read arbitrary PHP files from the server.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

eDirectory SQL注入漏洞

eDirectory是eDirectory公司的一个在线目录网站。 eDirectory存在SQL注入漏洞，该漏洞源于多个SQL注入漏洞，可能导致未经验证攻击者绕过管理员身份验证并泄露敏感文件。

N/A

N/A