VYPR
← All advisories
High severity8.2NVD Advisory· Published Mar 24, 2026· Updated Apr 15, 2026

CVE-2019-25643

CVE-2019-25643

Description

eNdonesia Portal v8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bid parameter. Attackers can send GET requests to banners.php with crafted SQL payloads in the bid parameter to extract sensitive database information from the INFORMATION_SCHEMA tables.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

eNdonesia Portal v8.7 suffers from unauthenticated SQL injection in banners.php via the bid parameter, allowing attackers to extract sensitive database contents.

Vulnerability

Overview

CVE-2019-25643 describes multiple SQL injection vulnerabilities in eNdonesia Portal version 8.7. The root cause is improper neutralization of special elements used in SQL commands (CWE-89) in the banners.php script [3]. The bid parameter is directly concatenated into SQL queries without sanitization, enabling attackers to inject arbitrary SQL payloads via GET requests [1].

Exploitation

This vulnerability can be exploited remotely without authentication. An attacker only needs to craft a malicious GET request to banners.php with a specially crafted bid parameter. Since no authentication is required and the attack vector is network-based, the barrier to exploitation is very low [3]. The official advisory on Exploit-DB provides proof-of-concept code demonstrating how to extract data from the INFORMATION_SCHEMA tables [1].

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL queries against the underlying database. This could lead to the exfiltration of sensitive information such as user credentials, personal data, or configuration secrets stored in the database [3]. The CVSS v3 base score of 8.2 reflects high impact to confidentiality, though integrity and availability are less affected.

Mitigation

As of the publication date, the project appears to be unmaintained; the vendor homepage and source code repository page remain available but no patch has been released [2]. Organizations using eNdonesia Portal v8.7 should consider migrating to an alternative, actively maintained platform to mitigate the risk of SQL injection and other vulnerabilities.

References
  1. OffSec’s Exploit Database Archive
  2. eNdonesia Portal
  3. eNdonesia Portal v8.7 SQL Injection via banners.php

AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

50