CVE-2019-25703

HIGH

ImpressCMS 1.3.11 SQL Injection via bid Parameter

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-25703 has a selected CVSS score of 7.1 (high); EIP currently links 1 catalogued exploit.

Description

ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'bid' parameter. Attackers can send POST requests to the admin.php endpoint with malicious 'bid' values containing SQL commands to extract sensitive database information.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 13, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

ImpressCMS

Browse Impresscms / ImpressCMS
CVE List1.3.11affected

Proofs of concept

1

Catalogued exploits

ExploitDBImpressCMS 1.3.11 - 'bid' SQL InjectionExploitDB exploitby Mehmet OnderNot analyzed1 file
ExploitDB
PoC details

References

5