CVE-2019-25580

HIGH

ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php

Title source: cna
STIX 2.1

Description

ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extract sensitive database information including version and database names.

Exploits (1)

exploitdb WORKING POC
by Ihsan Sencan · textwebappsphp
https://www.exploit-db.com/exploits/46168

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-46168
https://www.exploit-db.com/exploits/46168
Product product
Official Product Homepage
http://www.owndms.com/
Third Party Advisory third-party-advisory
VulnCheck Advisory: ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php
https://www.vulncheck.com/advisories/owndms-sql-injection-via-pdfstream-php-imagestream-php

Scores

CVSS v3 8.2
EPSS 0.0006
EPSS Percentile 17.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-434
Status published
Products (2)
owndms/owndms < 4.7
Owndms/ownDMS 4.7
Published Mar 21, 2026
Tracked Since Mar 21, 2026