PT-2026-21437 · Unknown · Microasp (Portal+) Cms

Publicado 2026-02-22 · Atualizado 2026-02-22 · CVE-2019-25366

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions microASP Portal+ CMS (affected versions not specified)

Description The software contains an SQL injection issue that allows attackers to execute arbitrary SQL queries. Unauthenticated attackers can inject malicious code into the explode tree parameter. Attackers can send crafted requests to the ''pagina.phtml'' endpoint with SQL injection payloads, utilizing the extractvalue and concat functions to extract sensitive database information, such as the current database name.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-25366

Produtos afetados

Microasp (Portal+) Cms

Referências · 6

• 🔥 https://exploit-db.com/exploits/46799 · Exploit
• https://t.me/cveNotify/152777 · Publicação no Telegram
• https://vulncheck.com/advisories/microasp-portal-cms-sql-injection-via-paginaphtml · Nota
• https://t.me/CVEtracker/45434 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-25366 · Nota de Segurança
• http://microasp.it · Nota