PT-2019-12428 · Doorgets · Doorgets

Published 2019-04-30 · Updated 2019-05-01 · CVE-2019-11621

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions doorGets version 7.0

Description The issue is related to a SQL injection vulnerability in the /doorgets/app/requests/user/configurationRequest.php endpoint when the action parameter is set to network. This could allow a remote background administrator privilege user, or a user with permission to manage network configuration, to exploit the vulnerability and obtain sensitive database information.

Recommendations For doorGets version 7.0, as a temporary workaround, consider restricting access to the /doorgets/app/requests/user/configurationRequest.php endpoint when the action parameter is set to network to minimize the risk of exploitation. Avoid using the action parameter with the value network in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-11621

Affected Products

Doorgets

References · 3

• 🔥 https://github.com/itodaro/doorGets_cve · Exploit
• https://osv.dev/vulnerability/CVE-2019-11621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11621 · Security Note