Cyber Resilience

CVE-2019-25515

HighPublic PoC

Published: 12 March 2026

Published
12 March 2026
Modified
17 March 2026
KEV Added
Patch
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0109 61.0th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25515 is a high-severity SQL Injection (CWE-89) vulnerability in Jettweb Php Stock News Site Script. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25515 is an authentication bypass vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V3, specifically within the login.php administration panel. The flaw allows unauthenticated attackers to gain administrative access by submitting crafted SQL syntax, such as equals signs and 'or' operators, as username and password parameters. This issue is classified under CWE-89 (SQL Injection) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Unauthenticated attackers with network access can exploit the vulnerability remotely with low attack complexity and no user interaction. Exploitation bypasses login credentials entirely, granting full administrative access to the panel and enabling high confidentiality impacts, such as unauthorized access to sensitive administrative data.

Advisories and exploit details are available from Vulncheck at https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-authentication-bypass and Exploit-DB at https://www.exploit-db.com/exploits/46599, which include proof-of-concept information. The CVE description does not specify patches or mitigations.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an authentication bypass vulnerability in the login.php administration panel that allows unauthenticated attackers to gain administrative access by submitting crafted SQL syntax. Attackers can bypass authentication by submitting equals signs and 'or'…

more

operators as username and password parameters to access the administration panel without valid credentials.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a SQL injection in a public-facing web application's login.php admin panel, enabling unauthenticated remote exploitation for administrative access, directly mapping to Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-25510Same product: Jettweb Php Stock News Site Script
CVE-2019-25516Same product: Jettweb Php Stock News Site Script
CVE-2019-25517Same product: Jettweb Php Stock News Site Script
CVE-2019-25520Same product: Jettweb Php Stock News Site Script
CVE-2019-25512Same product: Jettweb Php Stock News Site Script
CVE-2019-25519Same product: Jettweb Php Stock News Site Script
CVE-2019-25511Same product: Jettweb Php Stock News Site Script
CVE-2019-25518Same product: Jettweb Php Stock News Site Script
CVE-2019-25513Same product: Jettweb Php Stock News Site Script
CVE-2019-25514Same product: Jettweb Php Stock News Site Script

Affected Assets

jettweb
php stock news site script
3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-10 directly and comprehensively prevents SQL injection in login.php by validating username and password inputs against crafted SQL syntax like equals signs and 'or' operators.

prevent

SI-2 requires identification, reporting, and correction of the specific SQL injection flaw enabling authentication bypass to administrative access.

detect

RA-5 mandates scanning for vulnerabilities like the SQL injection in CVE-2019-25515 to identify it prior to exploitation.

References