CVE-2019-25482
Published: 12 March 2026
Summary
CVE-2019-25482 is a high-severity SQL Injection (CWE-89) vulnerability in Jettweb Php Ready Rent A Car Site Script. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25482 is an SQL injection vulnerability (CWE-89) in Jettweb PHP Hazir Rent A Car Sitesi Scripti V2. The flaw resides in the handling of the arac_kategori_id parameter, where insufficient input validation allows attackers to inject malicious SQL code through POST requests to affected endpoints, enabling manipulation of database queries.
Unauthenticated remote attackers can exploit this vulnerability with network access and low attack complexity, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Successful exploitation allows extraction of sensitive database information, such as user credentials or other confidential data stored in the backend database.
Advisories and related resources, including those at https://www.vulncheck.com/advisories/jettweb-php-hazir-rent-a-car-sitesi-scripti-v2-sql-injection and https://www.exploit-db.com/exploits/46624, document the issue and provide exploit details for security practitioners to assess and address exposures in deployed instances.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19772
Vulnerability details
Jettweb PHP Hazir Rent A Car Sitesi Scripti V2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the arac_kategori_id parameter. Attackers can send POST requests to the endpoint with malicious…
more
SQL payloads to extract sensitive database information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing PHP web app directly enables remote exploitation for database query manipulation and data extraction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the arac_kategori_id parameter to block malicious SQL payloads in POST requests, preventing database query manipulation.
Enforces restrictions on the arac_kategori_id input such as type, length, and format to reject SQL injection attempts at the application boundary.
Mandates timely remediation of the SQL injection flaw in the Jettweb PHP script to eliminate the vulnerability through patching or code fixes.