CVE-2019-25675

Deeper analysis

CVE-2019-25675 affects eDirectory, a web-based directory software, through multiple SQL injection vulnerabilities (CWE-89) in its parameters. These flaws enable unauthenticated attackers to inject SQL code, bypassing administrator authentication and disclosing sensitive files. The primary vector involves the key parameter in the login endpoint, which supports union-based SQL injection, while subsequent authenticated file disclosure occurs via language_file.php to access arbitrary PHP files on the server. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low complexity and no privileges required.

Unauthenticated remote attackers can exploit this vulnerability over the network without user interaction. By injecting malicious SQL into the login endpoint's key parameter, they achieve administrator authentication bypass. Once authenticated, attackers leverage the file disclosure flaw in language_file.php to read arbitrary PHP files, potentially exposing configuration data, source code, or other sensitive server information.

Advisories and resources detail the issue across all eDirectory versions, with a proof-of-concept exploit available on Exploit-DB (exploit 46423). The Vulncheck advisory highlights the SQL injection leading to authentication bypass, and the eDirectory vendor site provides context on the affected product. No specific patches or mitigations are detailed in the provided references.