CVE-2019-25730

Vulnerability

Listing Hub CMS version 1.0 contains a SQL injection vulnerability within the pages.php script. Unauthenticated attackers can exploit this by injecting malicious code into the id parameter via GET requests. This vulnerability allows for error-based SQL injection techniques to be used [1].

Exploitation

An attacker can exploit this vulnerability by sending crafted GET requests to pages.php with malicious values in the id parameter. No authentication is required, and the attacker only needs network access to the vulnerable CMS instance [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries. This can lead to the extraction of sensitive information such as database credentials, usernames, and version information. The scope of the compromise is limited to the database accessible by the CMS application [1].

Mitigation

No patch or fixed version information is available in the provided references. Users are advised to monitor for updates from the vendor. As of the publication of this advisory, there is no known workaround [1].