CVE-2019-25507

HighPublic PoC

Published: 04 March 2026

Published

04 March 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0024 14.5th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25507 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25507 is an SQL injection vulnerability (CWE-89) in Ashop Shopping Cart Software. The flaw resides in the 'shop' parameter of index.php, where insufficient input sanitization allows attackers to inject arbitrary SQL code into database queries.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted GET requests to index.php with malicious values in the 'shop' parameter. Using UNION-based SQL injection techniques, they can extract sensitive information from the database. The CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network accessibility with low complexity, no privileges or user interaction required, resulting in high confidentiality impact and low integrity impact.

References including Exploit-DB (exploit 46643) and a Vulncheck advisory detail the vulnerability and provide a proof-of-concept exploit demonstrating the SQL injection via the 'shop' parameter. No patches or specific mitigations are outlined in the available information.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-19733

Vulnerability details

Ashop Shopping Cart Software contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'shop' parameter. Attackers can send GET requests to index.php with malicious 'shop' values using UNION-based SQL injection…

to extract sensitive database information.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

CVE-2019-25507 is an unauthenticated SQL injection in a public-facing web application (T1190), enabling arbitrary database queries to extract sensitive information (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0