Cyber Resilience

CVE-2019-25512

HighPublic PoC

Published: 12 March 2026

Published
12 March 2026
Modified
17 March 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0033 24.8th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25512 is a high-severity SQL Injection (CWE-89) vulnerability in Jettweb Php Stock News Site Script. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25512 is an SQL injection vulnerability (CWE-89) affecting Jettweb PHP Hazir Haber Sitesi Scripti V3. The flaw exists in the handling of the "kelime" parameter in POST requests, where insufficient input validation allows attackers to inject malicious SQL commands. Specifically, UNION-based SQL injection payloads can be used to extract sensitive database information or modify database contents. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact.

Remote attackers require no privileges, user interaction, or special access to exploit the vulnerability by crafting POST requests with malicious payloads targeting the "kelime" parameter. Successful exploitation enables unauthorized extraction of sensitive data, such as user credentials or other database contents, and limited modification of database records, potentially compromising the confidentiality and integrity of the affected application.

Advisories detailing the vulnerability, including exploit information, are available from Exploit-DB at https://www.exploit-db.com/exploits/46599 and Vulncheck at https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-sql-injection-2.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows attackers to inject malicious SQL commands through the kelime parameter in POST requests. Attackers can manipulate the kelime parameter with UNION-based SQL injection payloads to extract…

more

sensitive database information or modify database contents.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct SQL injection in a public-facing PHP web application enables remote exploitation for data access/modification without authentication.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-25510Same product: Jettweb Php Stock News Site Script
CVE-2019-25516Same product: Jettweb Php Stock News Site Script
CVE-2019-25517Same product: Jettweb Php Stock News Site Script
CVE-2019-25520Same product: Jettweb Php Stock News Site Script
CVE-2019-25515Same product: Jettweb Php Stock News Site Script
CVE-2019-25519Same product: Jettweb Php Stock News Site Script
CVE-2019-25511Same product: Jettweb Php Stock News Site Script
CVE-2019-25518Same product: Jettweb Php Stock News Site Script
CVE-2019-25513Same product: Jettweb Php Stock News Site Script
CVE-2019-25514Same product: Jettweb Php Stock News Site Script

Affected Assets

jettweb
php stock news site script
3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mitigates SQL injection by validating and sanitizing the 'kelime' parameter in POST requests before database queries.

prevent

Identifies, reports, and corrects the specific SQL injection flaw in the Jettweb PHP script to prevent exploitation.

detectrespond

Scans for and detects SQL injection vulnerabilities like CVE-2019-25512, enabling timely remediation.

References