CVE-2019-25580
HIGH WAF: Medium
CVSS 8.2
Published: 2026-03-21
CWE-434
ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extract sensitive database information including version and database names.
WAF Coverage Analysis
Unrestricted File Upload
Medium WAF Coverage
OWASP: A04:2021 Insecure Design
930xxx - Local File Inclusion
Affected Software
| Vendor | Product | Version |
|---|---|---|
| owndms | owndms | up to 4.7 |
References
- www.owndms.com (Broken Link)
- datapacket.dl.sourceforge.net (Broken Link)
- www.exploit-db.com (Exploit, VDB Entry)
- www.vulncheck.com (Third Party Advisory)