CVE-2019-25432

Impact

Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to the application.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/Part-DB/Part-DB/
• https://www.exploit-db.com/exploits/47547
• https://www.vulncheck.com/advisories/part-db-authentication-bypass-via-loginphp