PT-2026-21437 · Unknown · Microasp (Portal+) Cms

Published 2026-02-22 · Updated 2026-02-22 · CVE-2019-25366

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions microASP Portal+ CMS (affected versions not specified)

Description The software contains an SQL injection issue that allows attackers to execute arbitrary SQL queries. Unauthenticated attackers can inject malicious code into the explode tree parameter. Attackers can send crafted requests to the ''pagina.phtml'' endpoint with SQL injection payloads, utilizing the extractvalue and concat functions to extract sensitive database information, such as the current database name.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-25366

Affected Products

Microasp (Portal+) Cms

References · 6

• 🔥 https://exploit-db.com/exploits/46799 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25366 · Security Note
• https://t.me/cveNotify/152777 · Telegram Post
• https://vulncheck.com/advisories/microasp-portal-cms-sql-injection-via-paginaphtml · Note
• https://t.me/CVEtracker/45434 · Telegram Post
• http://microasp.it · Note