CVE-2019-25433
Published: 22 February 2026
Summary
CVE-2019-25433 is a high-severity SQL Injection (CWE-89) vulnerability in Xoops (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25433 is an SQL injection vulnerability (CWE-89) in XOOPS CMS version 2.5.9. The flaw resides in the gerar_pdf.php endpoint, where the cid parameter fails to properly sanitize user input, allowing attackers to inject arbitrary SQL code into database queries.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. By sending crafted GET requests containing malicious values in the cid parameter, they can manipulate database queries to extract sensitive information. The CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects high confidentiality impact with low integrity impact and no availability impact.
Advisories and additional details are available from sources including Exploit-DB (which hosts a public exploit at https://www.exploit-db.com/exploits/46835), VulnCheck (https://www.vulncheck.com/advisories/xoops-cms-sql-injection-via-gerarpdfphp), and the official XOOPS site (https://xoops.org/). These references provide exploit code and vulnerability analysis, though specific patch information is not detailed in the CVE description.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19592
Vulnerability details
XOOPS CMS 2.5.9 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter. Attackers can send GET requests to the gerar_pdf.php endpoint with malicious cid values to extract sensitive…
more
database information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web endpoint (gerar_pdf.php) enables T1190 (Exploit Public-Facing Application). Allows arbitrary database queries for data extraction, facilitating T1213.006 (Data from Information Repositories: Databases).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the root cause by requiring validation and sanitization of user inputs like the 'cid' parameter to block SQL injection in database queries.
Mandates identification, reporting, and correction of the specific SQL injection flaw in the gerar_pdf.php endpoint of XOOPS CMS 2.5.9.
Requires vulnerability scanning to proactively identify the SQL injection vulnerability (CWE-89) via tools that test the 'cid' parameter in gerar_pdf.php.