CVE-2019-25517
Published: 12 March 2026
Summary
CVE-2019-25517 is a high-severity SQL Injection (CWE-89) vulnerability in Jettweb Php Stock News Site Script. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25517 is an SQL injection vulnerability (CWE-89) in Jettweb PHP Hazir Haber Sitesi Scripti version 1. The flaw resides in the haberarsiv.php component, where the cid parameter fails to properly sanitize user input, allowing attackers to inject malicious SQL code into database queries.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By sending HTTP requests to haberarsiv.php with crafted cid values, such as UNION-based payloads, they can extract sensitive database information or modify database contents.
Advisories and exploit details are available from references including Exploit-DB (https://www.exploit-db.com/exploits/46597) and VulnCheck (https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v1-sql-injection-via-haberarsiv-php), which document proof-of-concept exploits but do not specify patches or vendor-provided mitigations in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19794
Vulnerability details
Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter. Attackers can send requests to haberarsiv.php with malicious cid values using UNION-based…
more
injection to extract sensitive database information or modify database contents.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of unauthenticated SQL injection in a public-facing PHP web application component (haberarsiv.php).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validating and sanitizing the cid parameter in haberarsiv.php to block SQL injection payloads before they reach the database.
Mandates identification, reporting, and correction of the SQL injection flaw in the PHP script, eliminating the vulnerability through patching or code fixes.
Vulnerability scanning detects the SQLi in the cid parameter handling within haberarsiv.php, enabling timely remediation.