PT-2026-22958 · Phpads · Phpads

Publicado 2026-03-04 · Atualizado 2026-03-04 · CVE-2019-25503

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPads version 2.0

Description PHPads 2.0 has an SQL injection issue. Unauthenticated attackers can execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in the ''click.php3'' file. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue to extract sensitive database information, such as the current database name.

Recommendations Apply updates to address the issue in PHPads version 2.0. As a temporary workaround, restrict access to the ''click.php3'' file to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-25503

Produtos afetados

Phpads

Referências · 4

• 🔥 https://exploit-db.com/exploits/46798 · Exploit
• https://vulncheck.com/advisories/phpads-sql-injection-via-clickphp-bannerid · Nota
• https://osv.dev/vulnerability/CVE-2019-25503 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-25503 · Nota de Segurança