CVE-2019-25713

MyT-PM 1.5.1 SQL Injection via Charge[group_total] Parameter

Published Apr 12, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

MyT-PM 1.5.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the Charge[group_total] parameter. Attackers can submit crafted POST requests to the /charge/admin endpoint with error-based, time-based blind, or stacked query payloads to extract sensitive database information or manipulate data.

Analysis

Technical impact

The flaw arises from improper handling of the Charge[group_total] parameter at the /charge/admin endpoint in MyT‑PM 1.5.1. Because the application does not sanitize input, authenticated attackers can inject arbitrary SQL, allowing them to read or alter database data. This results in loss of confidentiality and integrity for sensitive information and may enable further manipulation of system state.

Affected Systems

The affected product is MyT:Project Management version 1.5.1, with the vulnerability located in the Charges module accessed through /charge/admin.

Risk and Exploitability

The CVSS score of 7.1 indicates a high impact. Although exploit probability (EPSS) data is not available, the vulnerability requires valid authentication, meaning only users with credentials can exploit it. Attackers can send crafted POST requests using error‑based, time‑based blind, or stacked query payloads to extract or modify data. The vulnerability is not listed in the CISA KEV catalog, implying no public exploitation at the time of reporting.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MyT

Project Management

affected

Version	Status	Constraints
`1.5.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:myt_project:myt:1.5.1:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Myt

Project Management

Version	Status	Scheme	Platform
`1.5.1`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor’s patch or upgrade to a fixed version of MyT‑PM.
If a patch is unavailable, limit access to the /charge/admin endpoint to privileged accounts and monitor for anomalous POST activity.
Validate or sanitize the Charge[group_total] input on the server side before execution.
If the Charges feature is not required, disable or remove it from the installation.

Generated by OpenCVE AI on April 12, 2026 at 13:20 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.281% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://manageyourteam.net/
https://sourceforge.net/projects/myt/
https://www.exploit-db.com/exploits/46084
https://www.vulncheck.com/advisories/myt-pm-sql-injection-via-charge-group-total-parameter

History

Jul 28, 2026 2:30 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Manageyourteam Manageyourteam myt Project Management
CPEs		cpe:2.3:a:manageyourteam:myt_project_management:1.5.1:::::::*
Vendors & Products		Manageyourteam Manageyourteam myt Project Management

Apr 17, 2026 2:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Myt Project Myt Project myt
CPEs		cpe:2.3:a:myt_project:myt:1.5.1:::::::*
Vendors & Products		Myt Project Myt Project myt

Apr 13, 2026 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 13, 2026 1:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Myt Myt project Management
Vendors & Products		Myt Myt project Management

Apr 12, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		MyT-PM 1.5.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the Charge[group_total] parameter. Attackers can submit crafted POST requests to the /charge/admin endpoint with error-based, time-based blind, or stacked query payloads to extract sensitive database information or manipulate data.
Title		MyT-PM 1.5.1 SQL Injection via Charge[group_total] Parameter
Weaknesses		CWE-89
References		https://manageyourteam.net/ https://sourceforge.net/projects/myt/ https://www.exploit-db.com/exploits/46084 https://www.vulncheck.com/advisories/myt-pm-sql-injection-via-charge-group-total-parameter
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}`