CVE-2019-25526
Published: 12 March 2026
Summary
CVE-2019-25526 is a high-severity SQL Injection (CWE-89) vulnerability in Inoutscripts Inout Homestay. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25526 is an SQL injection vulnerability (CWE-89) in Inout EasyRooms Ultimate Edition v1.0. The flaw resides in the search/searchdetailed endpoint, where the location parameter in POST requests fails to properly sanitize input, enabling attackers to inject arbitrary SQL code and manipulate database queries.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges, user interaction, or special setup. By sending crafted POST requests with malicious SQL payloads in the location field, they can extract sensitive data from the database (high confidentiality impact) or modify database contents (low integrity impact), though availability remains unaffected, as reflected in the CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Advisories detailing the vulnerability and proof-of-concept exploits are available at https://www.exploit-db.com/exploits/46630 and https://www.vulncheck.com/advisories/inout-easyrooms-ultimate-edition-sql-injection-via-search. No specific patches or mitigation steps are described in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19808
Vulnerability details
Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the location parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads in…
more
the location field to extract sensitive data or modify database contents.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application endpoint directly enables T1190 (Exploit Public-Facing Application) for unauthenticated remote access and facilitates T1213.006 (Data from Databases) for extracting sensitive data via arbitrary SQL queries.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the location parameter before database query processing.
Ensures timely identification, reporting, and correction of the specific SQL injection flaw in the searchdetailed endpoint.
Boundary protection mechanisms such as web application firewalls monitor and filter incoming POST requests to block SQL injection payloads targeting the location parameter.