CVE-2019-25481
Published: 12 March 2026
Summary
CVE-2019-25481 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25481 is an SQL injection vulnerability in iScripts ReserveLogic, affecting the search endpoint through the jqSearchDestination parameter. This flaw allows attackers to inject malicious SQL code into database queries via specially crafted POST requests. The vulnerability is classified under CWE-89 and carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability disruption.
Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction. By sending POST requests to the search endpoint with SQL payloads in the jqSearchDestination parameter, attackers can manipulate queries to extract sensitive database information, such as user credentials or other confidential data hosted by the application.
Advisories from Vulncheck document the SQL injection via the search endpoint in iScripts ReserveLogic, while a proof-of-concept exploit is publicly available on Exploit-DB (exploit ID 46640). No specific patches or mitigation steps are detailed in the provided references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19770
Vulnerability details
iScripts ReserveLogic contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the jqSearchDestination parameter. Attackers can send POST requests to the search endpoint with crafted SQL payloads to extract sensitive database…
more
information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in public-facing web application search endpoint enables T1190 (Exploit Public-Facing Application) for unauthenticated remote exploitation and facilitates T1213.006 (Data from Information Repositories: Databases) by allowing arbitrary extraction of sensitive database information like user credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly and comprehensively prevents SQL injection by validating and sanitizing untrusted inputs like the jqSearchDestination parameter in POST requests to block malicious SQL code.
SI-9 mitigates SQL injection by restricting the types, lengths, and characteristics of inputs to the search endpoint, preventing oversized or malformed SQL payloads.
SI-2 addresses this specific CVE by requiring timely identification, reporting, and remediation of the SQL injection flaw in iScripts ReserveLogic.