Cyber Resilience

CVE-2019-25493

HighPublic PoC

Published: 27 February 2026

Published
27 February 2026
Modified
06 March 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0032 23.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25493 is a high-severity SQL Injection (CWE-89) vulnerability in Doditsolutions Airbnb Clone Script. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25493 is an SQL injection vulnerability (CWE-89) in Homey BNB V4, an Airbnb clone script. The flaw resides in the admin/getrecord.php endpoint, where the 'val' parameter fails to properly sanitize user input, enabling attackers to inject arbitrary SQL code and manipulate database queries.

Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By sending crafted GET requests to admin/getrecord.php with malicious values in the 'val' parameter, they can extract sensitive database information, achieving high confidentiality impact and limited integrity disruption.

Advisories and proof-of-concept details are documented in references including the vendor site at https://www.doditsolutions.com/airbnb-clone-script/, an Exploit-DB entry at https://www.exploit-db.com/exploits/46616, and a Vulncheck advisory at https://www.vulncheck.com/advisories/homey-bnb-sql-injection-via-getrecordphp. These resources outline the issue but do not specify patches or mitigations in the available information.

A public proof-of-concept exploit on Exploit-DB highlights the vulnerability's exploitability in real-world scenarios.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'val' parameter. Attackers can send GET requests to the admin/getrecord.php endpoint with malicious 'val' values to extract sensitive…

more

database information.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct unauthenticated SQLi in public-facing admin endpoint enables exploitation of web application for data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-25494Same product: Doditsolutions Airbnb Clone Script
CVE-2019-25490Same product: Doditsolutions Airbnb Clone Script
CVE-2019-25489Same product: Doditsolutions Airbnb Clone Script
CVE-2019-25491Same product: Doditsolutions Airbnb Clone Script
CVE-2019-25492Same product: Doditsolutions Airbnb Clone Script
CVE-2026-24956Shared CWE-89
CVE-2026-33615Shared CWE-89
CVE-2025-28939Shared CWE-89
CVE-2021-47872Shared CWE-89
CVE-2025-28873Shared CWE-89

Affected Assets

doditsolutions
airbnb clone script
4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mandates validation of the 'val' parameter in admin/getrecord.php to block SQL injection by ensuring inputs conform to expected formats and content.

prevent

Restricts the 'val' parameter to authorized values or patterns, preventing malicious SQL code injection through input whitelisting or blacklisting.

prevent

Requires identification, reporting, and correction of the specific SQL injection flaw in admin/getrecord.php to eliminate the vulnerability.

References