CVE-2019-25707 is an SQL injection vulnerability in eBrigade ERP version 4.5 that enables authenticated attackers to execute arbitrary SQL queries through the 'id' parameter in pdf.php. By crafting malicious SQL payloads in GET requests, attackers can extract sensitive database information including table names and schema details. The vulnerability presents a HIGH severity risk with a CVSS score of 7.1, featuring a network attack vector with low complexity and requiring only low privilege authentication. While the attack does not compromise system availability, it poses significant confidentiality and limited integrity risks to affected systems. The vulnerability is not currently being actively exploited in the wild and is not listed on the CISA Known Exploited Vulnerabilities catalog. With a low EPSS score of 0.0003 and FAUCET risk score of 46.0/100, the vulnerability maintains a relatively low profile within the security community despite its technical severity.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.5CPE matchmatch criteria | cpe:2.3:a:ebrigade:ebrigade:4.5:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.