CVE-2019-16996

HIGHNuclei

metinfo metinfo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2019-16996 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 8, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

metinfo

Browse metinfo / metinfo
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHMetinfo 7.0.0 beta - SQL InjectionCVSS 7.2

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to a patched version of Metinfo or apply the necessary security patches to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorsritikchaddha
Template tagscve2019cvemetinfosqlivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:metinfo:metinfo:7.0.0:beta:*:*:*:*:*:*
https://github.com/XiaOkuoAi/XiaOkuoAi.github.io/issues/1 https://nvd.nist.gov/vuln/detail/CVE-2019-16996 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates https://github.com/StarCrossPortal/scalpel

Source: ProjectDiscovery

References

2