CVE-2019-25443
Published: 22 February 2026
Summary
CVE-2019-25443 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25443 is an SQL injection vulnerability in the Inventory Webapp, specifically affecting the add-item.php endpoint. The flaw allows attackers to inject malicious SQL code through GET parameters such as name, description, quantity, or cat_id, enabling manipulation of database queries and execution of arbitrary database commands. It is classified under CWE-89 with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility, low complexity, and no required privileges or user interaction.
Unauthenticated attackers can exploit this vulnerability remotely by supplying crafted SQL payloads in the specified GET parameters to the add-item.php script. Successful exploitation grants high confidentiality impact, such as extracting sensitive data from the database, with low integrity impact like limited data modification, and no availability disruption.
Advisories and related resources, including an exploit proof-of-concept on Exploit-DB (https://www.exploit-db.com/exploits/47356) and a detailed advisory from VulnCheck (https://www.vulncheck.com/advisories/inventory-webapp-sql-injection-via-add-itemphp), document the issue but do not specify patches or mitigations in the provided details. Security practitioners should review these references for remediation guidance, such as input sanitization or parameterized queries.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19604
Vulnerability details
Inventory Webapp contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can supply malicious SQL payloads in the name, description, quantity, or cat_id parameters to add-item.php to execute…
more
arbitrary database commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in unauthenticated public-facing webapp directly enables T1190 (Exploit Public-Facing Application) for initial access and facilitates T1213.006 (Databases) for arbitrary data extraction via crafted SQL queries.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing untrusted GET parameters (name, description, quantity, cat_id) before use in database queries.
Ensures timely identification, reporting, and correction of the SQL injection flaw in add-item.php to eliminate the vulnerability.
Detects the SQL injection vulnerability through regular vulnerability scanning of the web application, enabling remediation.