CVE-2019-16997

HIGHNuclei

Metinfo 7.0.0 beta - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-16997 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHMetinfo 7.0.0 beta - SQL InjectionCVSS 7.2

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to a patched version of Metinfo or apply the necessary security patches to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorsritikchaddha
Template tagscvecve2019metinfosqlivuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:metinfo:metinfo:7.0.0:beta:*:*:*:*:*:*
https://github.com/XiaOkuoAi/XiaOkuoAi.github.io/issues/2 https://nvd.nist.gov/vuln/detail/CVE-2019-16997 https://github.com/jweny/pocassistdb https://github.com/zhibx/fscan-Intranet https://github.com/0ps/pocassistdb

Source: ProjectDiscovery

References

2