CVE-2019-25491

HighPublic PoC

Published: 27 February 2026

Published

27 February 2026

Modified

06 March 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0032 23.8th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25491 is a high-severity SQL Injection (CWE-89) vulnerability in Doditsolutions Airbnb Clone Script. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25491 is an SQL injection vulnerability (CWE-89) affecting Homey BNB V4, an Airbnb clone script. The issue exists in the admin/cms_getpagetitle.php endpoint, where the catid parameter fails to properly sanitize user input, allowing attackers to inject arbitrary SQL code and manipulate database queries.

Unauthenticated attackers can exploit the vulnerability remotely by sending GET requests to the vulnerable endpoint with malicious values in the catid parameter. This enables extraction of sensitive database information, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact, low integrity impact, no availability impact, and low attack complexity over the network without privileges or user interaction.

Advisories and references include a proof-of-concept exploit documented on Exploit-DB (46616), details from DoDIT Solutions on the Airbnb clone script at https://www.doditsolutions.com/airbnb-clone-script/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/homey-bnb-sql-injection-via-cmsgetpagetitlephp. Practitioners should consult these sources for any available patches or mitigation recommendations, as no specific remediation steps are detailed in the core vulnerability description.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-19717

Vulnerability details

Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catid parameter. Attackers can send GET requests to the admin/cms_getpagetitle.php endpoint with malicious catid values to extract sensitive…

database information.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

Direct unauthenticated remote SQLi on public web endpoint enables T1190 exploitation; facilitates T1213.006 database data collection via injected queries.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0