CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2019-16996Public Exploit

Metinfo - SQLi (CVE-2019-16996)

PublishedSep 30, 2019
First SeenApr 7, 2025
Last Seen
Reported
CVSS7.2
Metinfo
MetinfoMetinfo

Description

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.

psychologyCrowdSec Analysis

CVE-2019-16996 is a vulnerability in Metinfo allowing attackers to perform SQL injection attacks through a specific administrative endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of April 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2019-16996 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2019-16996 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attempts to exploit this vulnerability typically target URLs containing /admin/?n=product&c=product_admin&a=dopara&app_type=shop.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2019-09-30
Rule Released2025-04-03
CrowdSec First Seen2025-04-07

Related Weaknesses

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References