CVE-2019-25515
Published: 12 March 2026
Summary
CVE-2019-25515 is a high-severity SQL Injection (CWE-89) vulnerability in Jettweb Php Stock News Site Script. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25515 is an authentication bypass vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V3, specifically within the login.php administration panel. The flaw allows unauthenticated attackers to gain administrative access by submitting crafted SQL syntax, such as equals signs and 'or' operators, as username and password parameters. This issue is classified under CWE-89 (SQL Injection) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Unauthenticated attackers with network access can exploit the vulnerability remotely with low attack complexity and no user interaction. Exploitation bypasses login credentials entirely, granting full administrative access to the panel and enabling high confidentiality impacts, such as unauthorized access to sensitive administrative data.
Advisories and exploit details are available from Vulncheck at https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-authentication-bypass and Exploit-DB at https://www.exploit-db.com/exploits/46599, which include proof-of-concept information. The CVE description does not specify patches or mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19790
Vulnerability details
Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an authentication bypass vulnerability in the login.php administration panel that allows unauthenticated attackers to gain administrative access by submitting crafted SQL syntax. Attackers can bypass authentication by submitting equals signs and 'or'…
more
operators as username and password parameters to access the administration panel without valid credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a SQL injection in a public-facing web application's login.php admin panel, enabling unauthenticated remote exploitation for administrative access, directly mapping to Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly and comprehensively prevents SQL injection in login.php by validating username and password inputs against crafted SQL syntax like equals signs and 'or' operators.
SI-2 requires identification, reporting, and correction of the specific SQL injection flaw enabling authentication bypass to administrative access.
RA-5 mandates scanning for vulnerabilities like the SQL injection in CVE-2019-25515 to identify it prior to exploitation.