CVE-2019-25489
Published: 27 February 2026
Summary
CVE-2019-25489 is a high-severity SQL Injection (CWE-89) vulnerability in Doditsolutions Airbnb Clone Script. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2019-25489 is a SQL injection vulnerability (CWE-89) present in Homey BNB V4, an Airbnb clone script. The flaw resides in the rooms/ajax_refresh_subtotal endpoint, where the hosting_id parameter is vulnerable to manipulation. Attackers can inject arbitrary SQL code through this parameter in GET requests, enabling unauthorized database query alterations.
Unauthenticated remote attackers can exploit the vulnerability with low complexity, requiring no privileges or user interaction. By crafting malicious hosting_id values in GET requests to the affected endpoint, they can extract sensitive database information or cause denial of service. The issue carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact per the vector.
Advisories and resources include a proof-of-concept exploit on Exploit-DB (46616), a VulnCheck advisory on the Homey BNB SQL injection via ajax_refresh_subtotal, and the vendor's Airbnb clone script page at doditsolutions.com/airbnb-clone-script. No specific patch or mitigation details are outlined in the provided references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19715
Vulnerability details
Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. Attackers can send GET requests to the rooms/ajax_refresh_subtotal endpoint with malicious hosting_id values to extract sensitive…
more
database information or cause denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2019-25489 is an unauthenticated SQL injection in a public-facing web endpoint (T1190: Exploit Public-Facing Application), enabling arbitrary database queries to extract sensitive information (T1213.006: Data from Information Repositories - Databases).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the hosting_id parameter in GET requests to the rooms/ajax_refresh_subtotal endpoint to prevent SQL injection payloads from manipulating database queries.
Boundary protection at web interfaces enables deployment of web application firewalls to inspect and block malicious SQL injection attempts in unauthenticated requests.
System monitoring detects anomalous database access patterns or unauthorized query executions indicative of successful or ongoing SQL injection exploitation.