Cyber Resilience

CVE-2019-25518

HighPublic PoC

Published: 12 March 2026

Published
12 March 2026
Modified
17 March 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0036 27.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25518 is a high-severity SQL Injection (CWE-89) vulnerability in Jettweb Php Stock News Site Script. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

Jettweb PHP Hazir Haber Sitesi Scripti V1 is affected by CVE-2019-25518, an SQL injection vulnerability (CWE-89) with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). The issue exists in the arama.php script, where the poll parameter lacks proper input sanitization, enabling attackers to inject arbitrary SQL code into database queries.

Unauthenticated remote attackers can exploit this vulnerability by sending POST requests to arama.php with malicious SQL payloads in the poll parameter. Successful exploitation allows extraction of sensitive data from the database due to high confidentiality impact, as well as limited integrity modifications such as altering database contents, though availability remains unaffected.

Advisories from Vulncheck detail the SQL injection via arama.php, while Exploit-DB provides a proof-of-concept exploit (ID 46597). No specific patches or vendor mitigations are referenced in the available information.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the poll parameter. Attackers can send POST requests to arama.php with malicious SQL payloads in…

more

the poll parameter to extract sensitive data or modify database contents.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct unauthenticated remote SQL injection in public-facing arama.php enables exploitation of a web application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-25510Same product: Jettweb Php Stock News Site Script
CVE-2019-25516Same product: Jettweb Php Stock News Site Script
CVE-2019-25517Same product: Jettweb Php Stock News Site Script
CVE-2019-25520Same product: Jettweb Php Stock News Site Script
CVE-2019-25515Same product: Jettweb Php Stock News Site Script
CVE-2019-25512Same product: Jettweb Php Stock News Site Script
CVE-2019-25519Same product: Jettweb Php Stock News Site Script
CVE-2019-25511Same product: Jettweb Php Stock News Site Script
CVE-2019-25513Same product: Jettweb Php Stock News Site Script
CVE-2019-25514Same product: Jettweb Php Stock News Site Script

Affected Assets

jettweb
php stock news site script
1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-10 directly requires validation and sanitization of untrusted inputs like the poll parameter in arama.php to prevent SQL injection exploitation.

prevent

SI-2 mandates identification, reporting, and correction of flaws such as the lack of input sanitization in the vulnerable arama.php script.

detectrespond

RA-5 requires vulnerability scanning to identify SQL injection flaws like CVE-2019-25518 and subsequent remediation based on risk assessment.

References