CVE-2019-17503

MEDIUM EXPLOITED NUCLEI

Kirona DRS 5.5.3.5 - Info Disclosure

Title source: llm

Exploitation Summary

CVE-2019-17503 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Ramikan. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates an HTML injection and reflected XSS vulnerability (CVE-2019-17504) via the 'password' parameter in Kirona DRS 5.5.3.5, as well as an unauthenticated sensitive data disclosure (CVE-2019-17503) through accessible batch files containing SQL queries.

Description

An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database information such as database version, table name, column name, etc.

Exploits (1)

exploitdb WORKING POC

by Ramikan · textwebappsphp

https://www.exploit-db.com/exploits/47498

View Code ZIP pw:eip

This exploit demonstrates an HTML injection and reflected XSS vulnerability (CVE-2019-17504) via the 'password' parameter in Kirona DRS 5.5.3.5, as well as an unauthenticated sensitive data disclosure (CVE-2019-17503) through accessible batch files containing SQL queries.

Classification

Working Poc 90%

Attack Type

Xss | Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Kirona Dynamic Resource Scheduler (DRS) 5.5.3.5

No auth needed

Prerequisites: Network access to the target application

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Kirona Dynamic Resource Scheduler - Information Disclosure

MEDIUMby LogicalHunter

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities

View Exploit ZIP pw:eip

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html

Scores

CVSS v3 5.3

EPSS 0.4924

EPSS Percentile 98.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

VulnCheck KEV 2023-11-26

CWE

CWE-425

Status published

Products (1)

kirona/dynamic_resource_scheduling 5.5.3.5

Published Oct 11, 2019

Tracked Since Feb 18, 2026