CVE-2019-25541

Netartmedia PHP Mall 4.1 is affected by CVE-2019-25541, a set of multiple SQL injection vulnerabilities classified under CWE-89. These flaws arise from unvalidated user inputs in specific parameters, enabling attackers to manipulate database queries. Vulnerable endpoints include the 'id' parameter in index.php and the 'Email' parameter in loginaction.php, which accept time-based blind SQL payloads without proper sanitization.

Unauthenticated remote attackers can exploit these vulnerabilities with low complexity and no user interaction required, as indicated by the CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Successful exploitation allows extraction of sensitive database information, such as credentials or other confidential data, through blind SQL injection techniques that infer results via query timing delays. The high confidentiality impact stems from potential data leakage, with limited integrity disruption.

Advisories from Vulncheck detail the multiple SQL injection issues and reference proof-of-concept exploits available on Exploit-DB (exploit 46562), confirming the attack vectors in index.php and loginaction.php. No patches or specific mitigation steps are outlined in the provided references, emphasizing the need for input validation, prepared statements, or upgrading to a non-vulnerable version if available.