Unrated severityNVD Advisory· Published Mar 21, 2026· Updated Mar 23, 2026

i-doit CMDB 1.12 SQL Injection via objGroupID Parameter

CVE-2019-25581

Description

i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the objGroupID parameter. Attackers can send GET requests with crafted SQL payloads in the objGroupID parameter to extract sensitive database information including usernames, database names, and version details.

Affected products

Ca/Cmdbllm-fuzzy
Range: =1.12
I-Doit/doit CMDBv5
Range: 1.12

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.exploit-db.com/exploits/46134mitreexploit
www.vulncheck.com/advisories/i-doit-cmdb-sql-injection-via-objgroupid-parametermitrethird-party-advisory
netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zipmitreproduct
www.i-doit.orgmitreproduct

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000