CVE-2019-13409: A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19)

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-17 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19). An attacker can use a union based injection query string though a search meeting room feature to get databases schema and username/password.

Affected products

TOPOO Technology TOPMeeting: before 8.8 — fixed in 8.8

How to fix

Upgrade to a fixed version: TOPOO Technology TOPMeeting 8.8. Check the vendor advisory for mitigations.

References

https://tvn.twcert.org.tw/taiwanvn/TVN-201907001
https://www.twcert.org.tw/en/cp-128-3019-f0dd8-2.html
https://tvn.twcert.org.tw/taiwanvn/TVN-201907001
https://www.twcert.org.tw/en/cp-128-3019-f0dd8-2.html

Get alerted when CVE-2019-13409 or the next vulnerability affects your stack