CVE-2019-5111CWE-89

Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1

High · published December 3, 2019

CVSS v3.0
7.4
EPSS
1%
Percentile
72.2
In the wild
Unconfirmed
What it is

Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_cat was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system.

The record
Technical detail
CVSS v3.0
7.4 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01393 · 72.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2019-12-03T21:37Z
EPSS history
Timeline
  • 03 DEC 21:37Z
    Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1
    cvelistv5