PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-25684 opendocman CVE debrief

CVE-2019-25684 is an SQL injection vulnerability in OpenDocMan 1.3.4. The vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter in search.php. Attackers can send GET requests with malicious SQL payloads to extract sensitive database information. This vulnerability has significant implications for the security of OpenDocMan 1.3.4 deployments, as it can be exploited to gain unauthorized access to sensitive data. Users of OpenDocMan 1.3.4 should be aware of this vulnerability and take steps to mitigate it promptly.

Vendor
opendocman
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-05
Original CVE updated
2026-07-24
Advisory published
2026-04-05
Advisory updated
2026-07-24

Who should care

Users of OpenDocMan 1.3.4 should be aware of this vulnerability and take steps to mitigate it. This vulnerability has a high CVSS score of 8.8, indicating a significant risk. Affected operators should review their deployments and implement patches or updates to prevent exploitation. Platform administrators should verify the version of OpenDocMan in use and apply necessary mitigations. Vulnerability management teams should prioritize this vulnerability for remediation, and security teams should monitor for suspicious activity.

Technical summary

The vulnerability exists in the search.php file of OpenDocMan 1.3.4. An unauthenticated attacker can inject malicious SQL code through the 'where' parameter, allowing them to manipulate database queries and potentially extract sensitive information. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

High priority should be given to mitigating this vulnerability, as it has a high CVSS score and allows unauthenticated attackers to manipulate database queries.

Recommended defensive actions

  • Inventory and verify the version of OpenDocMan in use.
  • Apply patches or updates to OpenDocMan to fix the SQL injection vulnerability.
  • Implement compensating controls, such as web application firewalls, to detect and prevent SQL injection attacks.
  • Monitor for suspicious activity and implement exception tracking to detect potential attacks.
  • Consider upgrading to a newer version of OpenDocMan if possible.

Evidence notes

The evidence for this vulnerability comes from the NVD and CVE.org. The NVD entry for this vulnerability provides a detailed description of the vulnerability and its CVSS vector. The CVE record provides additional information about the vulnerability, including its publication and modification dates.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-05T21:16:46.970Z and has not been modified since then.