PT-2025-34881 · Unknown · Diskover-Web

Published 2025-08-27 · Updated 2025-08-27 · CVE-2025-50984

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

diskover-web version 2.3.0

Description:

The application is susceptible to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration form. Improper input validation and parameterization in JSON-based query construction allows attackers to inject arbitrary SQLite expressions through unsanitized user input in POST parameters such as `ES PASS`, `ES MAXSIZE`, `ES TRANSLOGSIZE`, `ES TIMEOUT`, `ES USER`, `ES HOST`, `ES PORT`, `ES SCROLLSIZE`, and `ES CHUNKSIZE`. Successful exploitation can lead to the inference or extraction of sensitive information from the underlying database without authentication.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-50984

Affected Products

Diskover-Web

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-50984 · Security Note
• https://github.com/4rdr/proofs/blob/main/info/diskover-web-v2.3.0-community-edition-sqli.md · Note
• https://t.me/cveNotify/133763 · Telegram Post
• https://twitter.com/CVEnew/status/1960733663207023110 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1960747535720448101 · Twitter Post