CVE-2019-11623

Name of the Vulnerable Software and Affected Versions doorGets version 7.0

Description The issue allows a remote background administrator privilege user, or a user with permission to manage configuration siteweb, to exploit a SQL injection vulnerability. This vulnerability is located in the /doorgets/app/requests/user/configurationRequest.php endpoint when the action is set to siteweb. It can be exploited to obtain sensitive database information.

Recommendations For doorGets version 7.0, as a temporary workaround, consider restricting access to the /doorgets/app/requests/user/configurationRequest.php endpoint when the action is set to siteweb to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.