CVE-2019-19245

NAPC Xinet Elegant 6 Asset Library Web Interface v6.1.655 is affected by a Pre-Authentication SQL Injection in the /elegant6/login endpoint via the LoginForm[username] field when double quotes are used. Root cause is lack of input validation allowing SQL statements to be injected before authentic...