CVE-2019-19732 - CVE House
Back to Database
Status published High CVE-2019-19732

translation_manage_text.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3...

Vulnerability Description

translation_manage_text.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 directly insert values from the aSortDir_0 and/or sSortDir_0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-19732

Credits & Attribution

No credits recorded in the NVD database.

References

More from mfscripts

View All →
CVE-2019-20062
MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to...
Critical 9.8
CVE-2019-20061
The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may...
High 7.5
CVE-2019-20060
MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the...
High 7.5
CVE-2019-20059
payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4...
High 8.8
CVE-2019-19806
_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message...
Medium 5.3

Affected Vendor

Affected Software

yetishare
Vulnerable Versions:
3.5.2

Timeline

Official Publish: December 30th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.