CVE-2019-25511
Published: 12 March 2026
Summary
CVE-2019-25511 is a high-severity SQL Injection (CWE-89) vulnerability in Jettweb Php Stock News Site Script. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25511 is an SQL injection vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V3, affecting the fonksiyonlar.php component. The flaw arises from insufficient sanitization of the videoid parameter, enabling attackers to inject malicious SQL code via GET requests. This CWE-89 issue has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with network accessibility and no prerequisites for exploitation.
Unauthenticated remote attackers can exploit this vulnerability by crafting GET requests to fonksiyonlar.php with UNION-based SQL payloads in the videoid parameter. Successful exploitation allows manipulation of database queries to extract sensitive information, such as user credentials or other data stored in the backend database.
Advisories and resources, including an Exploit-DB entry (https://www.exploit-db.com/exploits/46599) providing a proof-of-concept and a VulnCheck advisory (https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-sql-injection), document the issue but do not specify available patches or vendor mitigations in the provided details.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19782
Vulnerability details
Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the videoid parameter. Attackers can send GET requests to fonksiyonlar.php with malicious videoid values using…
more
UNION-based injection to extract sensitive database information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated network exploitation of public-facing web app via SQL injection for data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient sanitization of the videoid parameter by requiring validation of inputs to block SQL injection payloads.
Enforces restrictions on the videoid GET parameter to limit or block malicious SQL code injection attempts.
Requires identification, reporting, and correction of the SQL injection flaw in fonksiyonlar.php to eliminate the vulnerability.