eDirectory 1.0 SQLi Auth Bypass + File Disclosure via key param
CVE-2019-25675 Published on April 5, 2026
eDirectory All Versions SQL Injection Authentication Bypass
eDirectory contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to bypass administrator authentication and disclose sensitive files by injecting SQL code into parameters. Attackers can exploit the key parameter in the login endpoint with union-based SQL injection to authenticate as administrator, then leverage authenticated file disclosure vulnerabilities in language_file.php to read arbitrary PHP files from the server.
Vulnerability Analysis
CVE-2019-25675 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is a SQL Injection Vulnerability?
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CVE-2019-25675 has been classified to as a SQL Injection vulnerability or weakness.
Products Associated with CVE-2019-25675
Want to know whenever a new CVE is published for Micro Focus Edirectory? stack.watch will email you.
Affected Versions
eDirectory Version 1.0 is affected by CVE-2019-25675Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.