CVE-2019-25703

Name of the Vulnerable Software and Affected Versions ImpressCMS version 1.3.11

Description Authenticated attackers can manipulate database queries by injecting SQL code through the bid parameter. This is achieved by sending POST requests to the 'admin.php' endpoint with malicious values to extract sensitive database information using time-based blind SQL injection, a technique that infers data by observing the time the server takes to respond to specific queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid using the bid parameter in the 'admin.php' endpoint.