SQL Injection in Epignosishq Efront Lms
CVE-2019-5070
An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier. Specially crafted web request to login page can cause SQL injections, resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.010 (62.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 62.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Epignosishq Efront Lms
- Epignosis — versions Epignosis eFront LMS v5.2.12
Weakness classification (CWE)
References
- talosintelligence.com/vulnerability_reports/TALOS-2019-0859 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-5070?
- CVE-2019-5070 is a medium-severity vulnerability in Epignosishq Efront Lms, classified under SQL Injection. CVSS score: 6.5/10. Published 2019-09-05.
- How severe is CVE-2019-5070?
- Medium severity. CVSS v3 base score is 6.5 out of 10.