CVE-2019-25703 - ImpressCMS 1.3.11 SQL Injection via bid Parameter

Back Back to CVE browser

HIGH

ImpressCMS 1.3.11 SQL Injection via bid Parameter

Published Apr 12, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.34%

Description

ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'bid' parameter. Attackers can send POST requests to the admin.php endpoint with malicious 'bid' values containing SQL commands to extract sensitive database information.

Affected products

Vendor Impresscms Product ImpressCMS Default
n/a
- Version
  1.3.11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Impresscms

ImpressCMS

n/a

Version	Status	Constraints
1.3.11	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (5)

http://www.impresscms.org/
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20134
Advisory
https://sourceforge.net/projects/impresscms/files/v1.3.11/impresscms_1.3.11.zip
product
https://www.exploit-db.com/exploits/46239
exploitThird Party AdvisoryVDB Entry
https://www.vulncheck.com/advisories/impresscms-sql-injection-via-bid-parameter
third-party-advisoryThird Party Advisory

Link	Providers	Tags
http://www.impresscms.org/		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20134		Advisory
https://sourceforge.net/projects/impresscms/files/v1.3.11/impresscms_1.3.11.zip		product
https://www.exploit-db.com/exploits/46239		exploitThird Party AdvisoryVDB Entry
https://www.vulncheck.com/advisories/impresscms-sql-injection-via-bid-parameter		third-party-advisoryThird Party Advisory