CVE-2019-25576
Published: 21 March 2026
Description
Kepler Wallpaper Script 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the category parameter. Attackers can send GET requests to the category endpoint with URL-encoded SQL UNION statements…
more
to extract database information including usernames, database names, and MySQL version details.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and sanitization of untrusted inputs like the category parameter to block SQL injection exploits in CVE-2019-25576.
Mandates identification, reporting, and correction of flaws such as the SQL injection vulnerability in Kepler Wallpaper Script 1.1 exploited via CVE-2019-25576.
Requires vulnerability scanning of web applications to identify SQL injection flaws like CVE-2019-25576 before exploitation.
Security SummaryAI
Kepler Wallpaper Script version 1.1 is affected by CVE-2019-25576, an SQL injection vulnerability (CWE-89) in the category parameter. This flaw enables unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code, such as URL-encoded SQL UNION statements, into GET requests sent to the category endpoint. The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low attack complexity over the network.
Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction. By crafting malicious GET requests to the category endpoint, they can extract sensitive database information, including usernames, database names, and MySQL version details, potentially leading to further compromise depending on the database contents and configuration.
Advisories and resources, including those from VulnCheck and Exploit-DB (exploit 46207), document the issue with proof-of-concept exploits. The original software is available via CodeClerks, and a live instance exists at keplerwallpapers.online, but no specific patches or mitigation steps are detailed in the provided references. Security practitioners should scan for and remove or update instances of Kepler Wallpaper Script 1.1.
Details
- CWE(s)