CVE-2019-25490

HighPublic PoC

Published: 27 February 2026

Published

27 February 2026

Modified

06 March 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0032 23.8th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25490 is a high-severity SQL Injection (CWE-89) vulnerability in Doditsolutions Airbnb Clone Script. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25490 is a SQL injection vulnerability in Homey BNB V4, an Airbnb clone script. The flaw exists in the admin/edit.php endpoint, where the 'id' parameter fails to properly sanitize user input, allowing attackers to inject SQL code and manipulate database queries. This CWE-89 issue has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low attack complexity over the network.

Unauthenticated attackers can exploit this vulnerability remotely by sending crafted GET requests to the admin/edit.php endpoint containing time-based SQL injection payloads. Successful exploitation enables extraction of sensitive database information, such as user credentials or other confidential data stored in the backend database.

Advisories and related resources, including those from Exploit-DB (exploit 46616) and Vulncheck, detail the vulnerability and provide proof-of-concept exploits. The DoD IT Solutions page describes the affected Homey BNB V4 product; practitioners should consult these references for detection signatures, patch availability, or workaround guidance specific to the software.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-19716

Vulnerability details

Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Attackers can send GET requests to the admin/edit.php endpoint with time-based SQL injection payloads to extract…

sensitive database information.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct remote unauthenticated SQL injection in public-facing web endpoint (admin/edit.php) enables exploitation of a public-facing application for initial access and database data exfiltration.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0