CVE-2019-25713

CVE-2019-25713 is an authenticated SQL injection vulnerability affecting MyT-PM version 1.5.1, where attackers can inject malicious SQL code through the Charge[group_total] parameter in POST requests to the /charge/admin endpoint. The vulnerability allows extraction of sensitive database information and data manipulation using error-based, time-based blind, or stacked query techniques. The vulnerability has a CVSS score of 8.1 (HIGH) with a network-based attack vector requiring low complexity and valid user credentials, but no user interaction. The impact assessment indicates high confidentiality and integrity risks, though availability is not affected. This represents a significant threat to authenticated users with administrative access. Exploitation status shows the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on public threat lists. The EPSS score of 0.0003 indicates minimal probability of exploitation in the wild, and there are no widely available public exploits, suggesting the vulnerability has received limited community attention since its disclosure in 2019.