PT-2019-17482 · Forma Spa · Forma Lms

Yuri Kramarz · Publicado 2019-12-03 · Atualizado 2022-07-17 · CVE-2019-5110

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Forma LMS version 2.2.1

Description Exploitable SQL injection vulnerabilities exist in the authenticated portion of the software. Specially crafted web requests can cause SQL injections, allowing an attacker to send a web request with parameters containing SQL injection attacks. This could potentially allow exfiltration of the database, user credentials, and in certain configurations, access to the underlying operating system.

Recommendations For Forma LMS version 2.2.1, update to a version that includes a fix for the SQL injection vulnerability. As a temporary workaround, consider restricting access to the authenticated portion of the software to minimize the risk of exploitation. Avoid using parameters that can contain SQL injection attacks in web requests until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-5110

Produtos afetados

Forma Lms

Referências · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0903 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5110 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5110 · Nota de Segurança
• https://t.me/cvenotify/33235 · Publicação no Telegram