nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-25505 CVE-2019-25505
HIGH
Tradebox 5.4 SQL Injection via symbol Parameter
Record summary
CVE-2019-25505 has a selected CVSS score of 7.1 (high); EIP currently links 1 catalogued exploit.
Description
Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the symbol parameter. Attackers can send POST requests to the monthly_deposit endpoint with malicious symbol values using boolean-based blind, time-based blind, error-based, or union-based SQL injection techniques to extract sensitive database information.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 5, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
TradeboxBrowse Bdtask / Tradebox | CVE List | 5.4 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBTradebox CryptoCurrency - 'symbol' SQL InjectionExploitDB exploitby Abdullah ÇelebiNot analyzed1 file
References
3ExploitDB-46671exploit
https://www.exploit-db.com/exploits/46671 VulnCheck Advisory: Tradebox 5.4 SQL Injection via symbol ParameterThird-party advisory
https://www.vulncheck.com/advisories/tradebox-sql-injection-via-symbol-parameter