CVE-2019-25521
Published: 12 March 2026
Summary
CVE-2019-25521 is a high-severity SQL Injection (CWE-89) vulnerability in Xooscripts Xoogallery. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25521 is an SQL injection vulnerability (CWE-89) in XooGallery Latest, affecting the gal.php component through the gal_id parameter. This flaw allows attackers to inject malicious SQL code into database queries via GET requests. The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no privileges required. By sending crafted GET requests to gal.php with malicious values in the gal_id parameter, they can manipulate database queries to extract sensitive information or modify database contents.
Advisories and related resources, including those from VulnCheck and an exploit listing on Exploit-DB (46609), detail the vulnerability but do not specify patches or mitigations in the provided information. Security practitioners should review these references for PoC details and apply input validation or upgrade to a patched version if available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19802
Vulnerability details
XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the gal_id parameter. Attackers can send GET requests to gal.php with malicious gal_id values to extract sensitive database information or…
more
modify database contents.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a public-facing web component (gal.php) directly enables remote exploitation of the application (T1190) and subsequent collection of data from backend databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information Input Validation directly prevents SQL injection by requiring validation and sanitization of the gal_id parameter in gal.php.
Flaw Remediation addresses the vulnerability by identifying, prioritizing, and applying patches or fixes for CVE-2019-25521 in XooGallery.
Monitoring for Information Disclosure detects exploitation attempts that extract sensitive database information via SQL injection in the gal_id parameter.