CVE-2019-25456

CriticalPublic PoC

Published: 22 February 2026

Published

22 February 2026

Modified

02 March 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Score 0.0016 36.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25456 is a critical-severity SQL Injection (CWE-89) vulnerability in Web-Ofisi Emlak. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mandates validation and sanitization of user inputs like the 'ara' GET parameter to block SQL injection payloads.

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of software flaws, such as the lack of input sanitization causing this SQL injection vulnerability.

SI-4 System Monitoring partial match

detect

Enables real-time monitoring to identify anomalous database queries or time-based SQL injection attempts.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing web app directly enables exploitation (T1190), arbitrary database queries for data extraction (T1213.006), and DoS conditions (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Web Ofisi Emlak v2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'ara' GET parameter. Attackers can send requests to with time-based SQL injection payloads to extract sensitive database…

information or cause denial of service.

Deeper analysisAI

CVE-2019-25456 is an SQL injection vulnerability (CWE-89) in Web Ofisi Emlak v2, where the 'ara' GET parameter fails to properly sanitize user input, allowing attackers to inject and manipulate database queries. This flaw affects the real estate script software, enabling arbitrary SQL code execution. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) and was published on 2026-02-22T15:16:15.187.

Unauthenticated attackers with network access can exploit this vulnerability remotely and with low complexity, without requiring user interaction. By sending crafted requests with time-based SQL injection payloads through the 'ara' parameter, they can extract sensitive database information or trigger denial of service conditions.

References include a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/47141), a Vulncheck advisory detailing the SQL injection via the 'ara' parameter (https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-ara-parameter), and the vendor product page for Emlak Scripti v2 (https://www.web-ofisi.com/detay/emlak-scripti-v2.html).