CVE-2019-25538

CVE-2019-25538 is an SQL injection vulnerability in 202CMS v10 beta, specifically through the log_user parameter. This flaw allows attackers to inject malicious SQL code into database queries, as the parameter fails to properly sanitize user input. Affected systems are instances of 202CMS v10 beta, a content management system hosted on SourceForge under the project name b202cms. The vulnerability is classified under CWE-89 and carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability disruption.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted HTTP requests containing malicious SQL statements in the log_user field. Successful exploitation enables manipulation of database queries, allowing extraction of sensitive information such as user credentials or other confidential data, or limited modification of database contents. The lack of authentication requirements (PR:N) and low attack complexity (AC:L) make it accessible to any network adversary without user interaction.

References include the 202CMS project page on SourceForge, a proof-of-concept exploit on Exploit-DB (ID 46579), and a detailed advisory from Vulncheck describing the SQL injection via the log_user parameter. No patches or specific mitigation steps are detailed in the provided information, emphasizing the need for input validation and prepared statements in similar applications.