PT-2019-17481 · Forma · Forma Lms

Published 2019-12-03 · Updated 2022-07-17 · CVE-2019-5109

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Forma LMS version 2.2.1

Description Exploitable SQL injection vulnerabilities exist in the authenticated portion of the software. Specially crafted web requests can cause SQL injections, potentially allowing exfiltration of the database, user credentials, and in certain configurations, access to the underlying operating system. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability.

Recommendations For Forma LMS version 2.2.1, update to a version that addresses the SQL injection vulnerability. As a temporary workaround, consider restricting access to the authenticated portion of the software to minimize the risk of exploitation. Avoid using parameters that can contain SQL injection attacks in web requests until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-5109

Affected Products

Forma Lms

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0902 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5109 · Security Note
• https://t.me/cvenotify/33236 · Telegram Post