CVE-2019-25703

HIGH

ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'bid' parameter. Attackers can send POST requests to the admin.php endpoint with malicious 'bid' values containing SQL commands to extract sensitive database information.

CVSS v3.1 Score

7.1
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
NONE
Published: 4/12/2026Modified: 4/17/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (4)

http://www.impresscms.org/Producthttps://sourceforge.net/projects/impresscms/files/v1.3.11/impresscms_1.3.11.zipProducthttps://www.exploit-db.com/exploits/46239ExploitThird Party Advisoryhttps://www.vulncheck.com/advisories/impresscms-sql-injection-via-bid-parameterThird Party Advisory