CVE-2019-17418: MetInfo 7.0 admin parameter SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh CVSS severity and a very high EPSS percentile with public exploit code, though exploitation requires prior admin access.

What it is

MetInfo 7.0 contains a SQL injection flaw in the admin language parameter search endpoint (admin/?n=language&c=language_general&a=doSearchParameter), reachable through the appno parameter. It is a distinct issue from CVE-2019-16997, and because it sits in the admin interface it matters mainly for environments where administrative access is weakly controlled or credentials are reused.

Impact

An attacker with admin-level access can inject SQL to read or modify database contents, potentially exposing credentials and site data or altering stored records. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network via an HTTP request to the admin language search endpoint with a crafted appno parameter. The CVSS vector requires high privileges (PR:H) and no user interaction, so the attacker must already hold an administrative session or credentials.

Exploitation

No CISA KEV listing and no ransomware association; EPSS is 0.49299 (98.8th percentile), and both references are tagged Exploit, indicating public proof-of-concept code exists.

What to do

• Apply the vendor fix for MetInfo 7.0 or upgrade to a release that addresses this SQL injection.
• Restrict access to the admin interface by IP allowlist or VPN so the vulnerable endpoint is not internet-exposed.
• Enforce strong, unique admin credentials and rotate any that may have been exposed.
• Review database accounts used by the application and remove unnecessary write or file privileges.
• Monitor and alert on unusual queries or error responses from the admin language search endpoint.

Detection

• Search web logs for requests to admin/?n=language&c=language_general&a=doSearchParameter with suspicious appno values containing SQL syntax.
• Alert on SQL error strings or unexpected 500 responses from admin endpoints.
• Baseline normal admin traffic and flag anomalous query volume or parameter patterns from a single source.
• Review database audit logs for unexpected SELECT, UNION or stacked statements originating from the web application.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.