eDirectory All Versions SQL Injection Authentication Bypass

CVE-2019-25675 影响 eDirectory，暴露了多个 SQL 注入漏洞。这些缺陷允许未经身份验证的攻击者绕过管理员身份验证，并可能从服务器泄露敏感文件。攻击重点在于登录端点中的关键参数，其中可以使用“基于 UNION 的 SQL 注入”技术注入 SQL 代码，以模拟管理员身份验证。身份验证后，攻击者可以利用 language_file.php 中的经过身份验证的文件泄露漏洞来读取任意 PHP 文件，从而可能损害 eDirectory 应用程序的完整性和保密性。该漏洞的 CVSS 评分达到 8.2，表明存在重大风险。

Organizations using eDirectory versions 1.0.0 through 1.0, particularly those with publicly accessible eDirectory instances, are at significant risk. Shared hosting environments where multiple users share the same server are also at increased risk, as a compromise of one user's eDirectory instance could potentially lead to the compromise of others.

• php: Examine access logs for suspicious SQL injection attempts targeting the login endpoint. Look for unusual characters or patterns in the 'key' parameter.

grep -i 'union select' /var/log/apache2/access.log

• php: Review language_file.php for any unusual code or modifications that could facilitate file disclosure.

find /var/www/html/edirectory -name language_file.php -print

• generic web: Monitor network traffic for connections to the eDirectory server from unusual IP addresses or locations. • generic web: Check for unexpected files or directories on the server that may have been created by an attacker.

1. 2026-04-05Disclosure

   disclosure

1. 已保留2026-04-05
2. 发布日期2026-04-05
3. 修改日期2026-04-06
4. EPSS 更新日期2026-04-13

目前，供应商尚未为 CVE-2019-25675 提供官方修复程序。立即减轻风险需要彻底审查 eDirectory 源代码，以识别和修复 SQL 注入和文件泄露漏洞。强烈建议实施 Web 应用程序防火墙 (WAF)，以过滤恶意流量并阻止 SQL 注入尝试。此外，遵守“最小权限”原则，限制用户和服务的权限，对于最大限度地减少潜在漏洞的影响至关重要。积极监控服务器日志以检测可疑的攻击模式也很重要。由于缺乏补丁，如果可用，升级到 eDirectory 的更安全版本是长期来看的最佳选择。