CVE-2019-25525

HighPublic PoC

Published: 12 March 2026

Published

12 March 2026

Modified

19 March 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0026 49.7th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25525 is a high-severity SQL Injection (CWE-89) vulnerability in Inoutscripts Inout Homestay. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates SQL injection in the 'guests' parameter by requiring validation of all user inputs before incorporation into database queries.

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of known flaws like CVE-2019-25525 through identification, reporting, patching, and testing to eliminate the SQL injection vulnerability.

SI-9 Information Input Restrictions partial match

prevent

Restricts harmful inputs to the /search/rentals endpoint, such as limiting special characters in the 'guests' parameter to block SQL injection payloads.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing web application (T1190) enables unauthorized database access and data extraction (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the guests parameter. Attackers can send POST requests to the search/rentals endpoint with malicious SQL payloads to…

bypass authentication, extract sensitive data, or modify database contents.

Deeper analysisAI

CVE-2019-25525 is an SQL injection vulnerability (CWE-89) in Inout EasyRooms Ultimate Edition v1.0. The flaw resides in the handling of the "guests" parameter within POST requests to the /search/rentals endpoint, enabling attackers to inject arbitrary SQL code into database queries. Published on 2026-03-12, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with moderate overall severity.

Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction by sending crafted POST requests containing malicious SQL payloads. Exploitation allows bypassing authentication mechanisms, extracting sensitive data from the database, or modifying database contents, potentially leading to unauthorized access and data compromise.

Advisories referenced in Exploit-DB (https://www.exploit-db.com/exploits/46630) and Vulncheck (https://www.vulncheck.com/advisories/inout-easyrooms-ultimate-edition-sql-injection-via-search-2) provide further details on the issue, including proof-of-concept exploits that security practitioners should review for mitigation guidance such as input sanitization or upgrading the software.