CVE-2019-25703

CVE-2019-25703 is a time-based blind SQL injection vulnerability in ImpressCMS version 1.3.11 that enables authenticated attackers to manipulate database queries through the 'bid' parameter in the admin.php endpoint. By sending specially crafted POST requests with malicious SQL code, attackers can extract sensitive information from the underlying database. This vulnerability requires valid user authentication to exploit, limiting the attack surface to authenticated users with access to administrative functions. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a network attack vector, low complexity, and low privileges required. The impact is severe, with attackers capable of achieving high confidentiality, integrity, and availability impacts. The EPSS score of 0.0005 indicates this vulnerability has minimal prevalence relative to other CVEs, though the functional database access it provides makes it operationally significant for affected systems. This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no active exploitation in the wild. The vulnerability remains on inactive status in threat intelligence tracking lists, suggesting limited community attention and low immediate exploitation activity. However, organizations running ImpressCMS 1.3.11 should prioritize patching due to the high severity rating and the authenticated but impactful nature of the SQL injection flaw.