CVE-2019-25458

CriticalPublic PoC

Published: 22 February 2026

Published

22 February 2026

Modified

02 March 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0017 38.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25458 is a critical-severity SQL Injection (CWE-89) vulnerability in Web-Ofisi Firma Rehberi. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-14 (Public Access Protections) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of untrusted GET parameters like 'il', 'kat', and 'kelime' to prevent SQL injection from manipulating database queries.

SI-2 Flaw Remediation good match

prevent

Directly addresses remediation of the specific SQL injection flaw in Web Ofisi Firma Rehberi v1 to eliminate the vulnerability.

SC-14 Public Access Protections good match

prevent

Provides protections for publicly accessible web endpoints against unauthorized disclosure, modification, and insertion of malicious SQL payloads.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in a public-facing web application directly enables exploitation of public-facing applications (T1190) for unauthenticated remote access, data exfiltration, modification, and denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Web Ofisi Firma Rehberi v1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can send requests to with malicious payloads in the 'il', 'kat', or 'kelime' parameters…

to extract sensitive database information or perform time-based blind SQL injection attacks.

Deeper analysisAI

CVE-2019-25458 is an SQL injection vulnerability (CWE-89) in Web Ofisi Firma Rehberi v1, published on 2026-02-22. The flaw allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters such as 'il', 'kat', or 'kelime' in requests to affected endpoints. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its potential for high impacts on confidentiality, integrity, and availability.

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending requests with malicious payloads in the specified parameters, they can extract sensitive database information or conduct time-based blind SQL injection attacks, enabling data exfiltration, modification, or denial of service.

Advisories and related resources include an exploit proof-of-concept at https://www.exploit-db.com/exploits/47143, a vulnerability advisory at https://www.vulncheck.com/advisories/web-ofisi-firma-rehberi-sql-injection-via-firmalarhtml, and the product page at https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html. These references provide details on the issue but do not specify patches or mitigations in the available information.

A public exploit on Exploit-DB indicates potential for real-world exploitation against unpatched instances of this directory script.