PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-25684 opendocman CVE debrief

CVE-2019-25684 is an SQL injection vulnerability in OpenDocMan 1.3.4. The vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter in search.php. Attackers can send GET requests with malicious SQL payloads to extract sensitive database information. This vulnerability has significant implications for the security of OpenDocMan 1.3.4 deployments, as it can be exploited to gain unauthorized access to sensitive data. Users of OpenDocMan 1.3.4 should be aware of this vulnerability and take steps to mitigate it promptly.

Vendor
opendocman
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-05
Original CVE updated
2026-07-24
Advisory published
2026-04-05
Advisory updated
2026-07-24

Who should care

Users of OpenDocMan 1.3.4 should be aware of this vulnerability and take steps to mitigate it. This vulnerability has a high CVSS score of 8.8, indicating a significant risk. Affected operators should review their deployments and implement patches or updates to prevent exploitation. Platform administrators should verify the version of OpenDocMan in use and apply necessary mitigations. Vulnerability management teams should prioritize this vulnerability for remediation, and security teams should monitor for suspicious activity.

Technical summary

The vulnerability exists in the search.php file of OpenDocMan 1.3.4. An unauthenticated attacker can inject malicious SQL code through the 'where' parameter, allowing them to manipulate database queries and potentially extract sensitive information. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

High priority should be given to mitigating this vulnerability, as it has a high CVSS score and allows unauthenticated attackers to manipulate database queries.

Recommended defensive actions

  • Inventory and verify the version of OpenDocMan in use.
  • Apply patches or updates to OpenDocMan to fix the SQL injection vulnerability.
  • Implement compensating controls, such as web application firewalls, to detect and prevent SQL injection attacks.
  • Monitor for suspicious activity and implement exception tracking to detect potential attacks.
  • Consider upgrading to a newer version of OpenDocMan if possible.

Evidence notes

The evidence for this vulnerability comes from the NVD and CVE.org. The NVD entry for this vulnerability provides a detailed description of the vulnerability and its CVSS vector. The CVE record provides additional information about the vulnerability, including its publication and modification dates.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-25684 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-25684

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-25684 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-25684

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.