CVE-2019-25581 - i-doit CMDB 1.12 SQL Injection via objGroupID Parameter

Back Back to CVE browser

HIGH

i-doit CMDB 1.12 SQL Injection via objGroupID Parameter

Published Mar 21, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.35%

Description

i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the objGroupID parameter. Attackers can send GET requests with crafted SQL payloads in the objGroupID parameter to extract sensitive database information including usernames, database names, and version details.

Affected products

Vendor I-Doit Product doit CMDB Default
n/a
- Version
  1.12
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

I-Doit

doit CMDB

n/a

Version	Status	Constraints
1.12	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zip
product
https://www.exploit-db.com/exploits/46134
exploitThird Party AdvisoryVDB Entry
https://www.i-doit.org/
product
https://www.vulncheck.com/advisories/i-doit-cmdb-sql-injection-via-objgroupid-parameter
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zip		product
https://www.exploit-db.com/exploits/46134		exploitThird Party AdvisoryVDB Entry
https://www.i-doit.org/		product
https://www.vulncheck.com/advisories/i-doit-cmdb-sql-injection-via-objgroupid-parameter		third-party-advisoryThird Party Advisory