CVE-2019-25512
Published: 12 March 2026
Summary
CVE-2019-25512 is a high-severity SQL Injection (CWE-89) vulnerability in Jettweb Php Stock News Site Script. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25512 is an SQL injection vulnerability (CWE-89) affecting Jettweb PHP Hazir Haber Sitesi Scripti V3. The flaw exists in the handling of the "kelime" parameter in POST requests, where insufficient input validation allows attackers to inject malicious SQL commands. Specifically, UNION-based SQL injection payloads can be used to extract sensitive database information or modify database contents. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact.
Remote attackers require no privileges, user interaction, or special access to exploit the vulnerability by crafting POST requests with malicious payloads targeting the "kelime" parameter. Successful exploitation enables unauthorized extraction of sensitive data, such as user credentials or other database contents, and limited modification of database records, potentially compromising the confidentiality and integrity of the affected application.
Advisories detailing the vulnerability, including exploit information, are available from Exploit-DB at https://www.exploit-db.com/exploits/46599 and Vulncheck at https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-sql-injection-2.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19784
Vulnerability details
Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows attackers to inject malicious SQL commands through the kelime parameter in POST requests. Attackers can manipulate the kelime parameter with UNION-based SQL injection payloads to extract…
more
sensitive database information or modify database contents.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct SQL injection in a public-facing PHP web application enables remote exploitation for data access/modification without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection by validating and sanitizing the 'kelime' parameter in POST requests before database queries.
Identifies, reports, and corrects the specific SQL injection flaw in the Jettweb PHP script to prevent exploitation.
Scans for and detects SQL injection vulnerabilities like CVE-2019-25512, enabling timely remediation.