CVE-2019-25693

CVE-2019-25693 is a SQL injection vulnerability in ResourceSpace 8.6 that affects the collection_edit.php file, allowing authenticated users to inject arbitrary SQL commands through the keywords parameter. Attackers can submit malicious POST requests containing crafted SQL payloads to compromise the integrity of the backend database. The vulnerability carries a CVSS score of 7.1 (HIGH) and requires low attack complexity with network accessibility. The primary impact is confidentiality loss through unauthorized extraction of sensitive database information such as schema structures, user credentials, and other confidential data, with limited integrity compromise. Exploitation requires valid authentication credentials, which moderates the overall risk profile. Current exploitation status indicates this vulnerability is not actively weaponized in the wild, as evidenced by the absence of CVE entries in the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on security hot lists. The EPSS score of 0.000170000 reflects minimal probability of exploitation in real-world scenarios. However, the moderate FAUCET Risk Score of 46.0 suggests organizations should prioritize patching, particularly if they operate ResourceSpace instances with sensitive data and broad user access.