CVE-2019-25498
Published: 04 March 2026
Summary
CVE-2019-25498 is a high-severity SQL Injection (CWE-89) vulnerability in Simplejobscript Simplejobscript. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25498 is an SQL injection vulnerability (CWE-89) in Simple Job Script, affecting the searched endpoint. The flaw arises from improper handling of the landing_location parameter, which allows attackers to inject malicious SQL code into database queries. It carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low attack complexity and no privileges required.
Unauthenticated attackers can exploit this vulnerability remotely by sending POST requests to the searched endpoint with SQL payloads in the landing_location parameter. Successful exploitation enables manipulation of database queries to bypass authentication mechanisms and extract sensitive information from the database.
Advisories and proof-of-concept exploits are available at https://www.exploit-db.com/exploits/46612 and https://www.vulncheck.com/advisories/simple-job-script-sql-injection-via-searched-endpoint, which detail the vulnerability and potential exploitation paths.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19724
Vulnerability details
Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the landing_location parameter. Attackers can send POST requests to the searched endpoint with malicious SQL payloads to bypass authentication…
more
and extract sensitive database information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2019-25498 is an unauthenticated SQL injection in a public-facing web application endpoint, directly enabling T1190 (Exploit Public-Facing Application). Exploitation facilitates arbitrary database queries for data extraction, mapping to T1213.006 (Data from Information Repositories: Databases).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of the landing_location parameter at the searched endpoint before database query execution.
Mandates timely identification, reporting, and correction of the specific SQL injection flaw in the Simple Job Script application.
Enforces restrictions on input format and content for the landing_location parameter to block malicious SQL payloads at the critical entry point.