CVE-2019-25662
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'ref' parameter. Attackers can send GET requests to the watched_searches.php endpoint with crafted SQL payloads.
Risk Assessment
Successful exploitation enables extraction of sensitive database information, including usernames and credentials, potentially leading to full system compromise.
Recommendation
Immediately upgrade ResourceSpace to the latest version and apply security patches. Also consider using a Web Application Firewall (WAF) to block SQL injection attacks.
Other vulnerabilities in ResourceSpace
Original NVD description (English source)
ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'ref' parameter. Attackers can send GET requests to the watched_searches.php endpoint with crafted SQL payloads to extract sensitive database information including usernames and credentials.