CVE-2019-25525
Published: 12 March 2026
Summary
CVE-2019-25525 is a high-severity SQL Injection (CWE-89) vulnerability in Inoutscripts Inout Homestay. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25525 is an SQL injection vulnerability (CWE-89) in Inout EasyRooms Ultimate Edition v1.0. The flaw resides in the handling of the "guests" parameter within POST requests to the /search/rentals endpoint, enabling attackers to inject arbitrary SQL code into database queries. Published on 2026-03-12, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with moderate overall severity.
Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction by sending crafted POST requests containing malicious SQL payloads. Exploitation allows bypassing authentication mechanisms, extracting sensitive data from the database, or modifying database contents, potentially leading to unauthorized access and data compromise.
Advisories referenced in Exploit-DB (https://www.exploit-db.com/exploits/46630) and Vulncheck (https://www.vulncheck.com/advisories/inout-easyrooms-ultimate-edition-sql-injection-via-search-2) provide further details on the issue, including proof-of-concept exploits that security practitioners should review for mitigation guidance such as input sanitization or upgrading the software.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19807
Vulnerability details
Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the guests parameter. Attackers can send POST requests to the search/rentals endpoint with malicious SQL payloads to…
more
bypass authentication, extract sensitive data, or modify database contents.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (T1190) enables unauthorized database access and data extraction (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection in the 'guests' parameter by requiring validation of all user inputs before incorporation into database queries.
Requires timely remediation of known flaws like CVE-2019-25525 through identification, reporting, patching, and testing to eliminate the SQL injection vulnerability.
Restricts harmful inputs to the /search/rentals endpoint, such as limiting special characters in the 'guests' parameter to block SQL injection payloads.