CVE-2019-25519
Published: 12 March 2026
Summary
CVE-2019-25519 is a high-severity SQL Injection (CWE-89) vulnerability in Jettweb Php Stock News Site Script. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25519 is an SQL injection vulnerability (CWE-89) affecting Jettweb PHP Hazir Haber Sitesi Scripti V1, published on 2026-03-12 with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). The issue stems from inadequate sanitization of the "option" parameter in the uyelik.php script, enabling attackers to inject malicious SQL code through POST requests and manipulate database queries.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity by crafting POST requests to uyelik.php containing time-based SQL injection payloads in the "option" parameter. Successful exploitation allows extraction of sensitive database information, resulting in high confidentiality impact, low integrity impact, and no availability disruption.
Advisories and references, including those from VulnCheck (https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v1-sql-injection) and Exploit-DB (https://www.exploit-db.com/exploits/46597), document the vulnerability with proof-of-concept details but do not specify patches or mitigations in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19798
Vulnerability details
Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the option parameter. Attackers can send POST requests to uyelik.php with crafted payloads in the…
more
option parameter to execute time-based SQL injection attacks and extract sensitive database information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote SQL injection in a public-facing PHP web application enables initial access via exploitation of the exposed uyelik.php endpoint.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of information inputs like the 'option' parameter, directly preventing SQL injection by ensuring malicious SQL code is rejected or sanitized before database query execution.
SI-9 enforces restrictions on inputs such as whitelisting valid values for the 'option' parameter, blocking crafted SQL injection payloads in POST requests to uyelik.php.
SI-2 requires timely remediation of flaws like the unsanitized 'option' parameter in uyelik.php, preventing exploitation through patching or code fixes.