CVE-2019-17503

An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database information such as database version, table name, column name, etc.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

48.30% chance of exploitation in the next 30 days, 99th percentile

Nuclei

medium · CWE-425

Published

2019-10-11

Updated

2024-08-05

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17503.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/47498

References

• CVE Record
• NVD entry

Related

• CVE-2019-17502
• CVE-2019-17504
• CVE-2019-17497
• CVE-2019-17505
• CVE-2019-17495
• CVE-2019-17506