PT-2019-18728

CVE-2019-7730

Published

2019-02-11

Updated

2019-02-12

Description by

CVSS 3.1

5.7

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MyWebSQL version 3.7

Description The issue allows for Cross-site request forgery (CSRF) that can be used to delete a database. This can be achieved via the "/?q=wrkfrm&type=databases" API endpoint.

Recommendations For MyWebSQL version 3.7, consider restricting access to the "/?q=wrkfrm&type=databases" API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Eddie Tc Chang

Yu-Hsiang Huang

Yung-Hao Tseng

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers