CVE-2019-17119

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Oct/35Exploit, Mailing List, Third Party Advisory
https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-sql-injectionExploit, Third Party Advisory
http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Oct/35Exploit, Mailing List, Third Party Advisory
https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-sql-injectionExploit, Third Party Advisory

Timeline

Published: Oct 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-17127.5A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker CVE-2019-171206.1A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to CVE-2019-171215.4REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values.CVE-2019-171237.5The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as CVE-2019-171249.8Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.CVE-2019-171256.1A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An CVE-2019-171276.1A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application f CVE-2019-171287.5Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of CVE-2019-17138.8A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, re CVE-2019-171306.5vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.CVE-2019-171314.3vBulletin before 5.5.4 allows clickjacking.CVE-2019-171329.8vBulletin through 5.5.4 mishandles custom avatars.