CVE-2019-25526

HighPublic PoC

Published: 12 March 2026

Published

12 March 2026

Modified

19 March 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0018 38.9th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25526 is a high-severity SQL Injection (CWE-89) vulnerability in Inoutscripts Inout Homestay. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the location parameter before database query processing.

SI-2 Flaw Remediation good match

prevent

Ensures timely identification, reporting, and correction of the specific SQL injection flaw in the searchdetailed endpoint.

SC-7 Boundary Protection partial match

preventdetect

Boundary protection mechanisms such as web application firewalls monitor and filter incoming POST requests to block SQL injection payloads targeting the location parameter.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing web application endpoint directly enables T1190 (Exploit Public-Facing Application) for unauthenticated remote access and facilitates T1213.006 (Data from Databases) for extracting sensitive data via arbitrary SQL queries.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the location parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads in…

the location field to extract sensitive data or modify database contents.

Deeper analysisAI

CVE-2019-25526 is an SQL injection vulnerability (CWE-89) in Inout EasyRooms Ultimate Edition v1.0. The flaw resides in the search/searchdetailed endpoint, where the location parameter in POST requests fails to properly sanitize input, enabling attackers to inject arbitrary SQL code and manipulate database queries.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges, user interaction, or special setup. By sending crafted POST requests with malicious SQL payloads in the location field, they can extract sensitive data from the database (high confidentiality impact) or modify database contents (low integrity impact), though availability remains unaffected, as reflected in the CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Advisories detailing the vulnerability and proof-of-concept exploits are available at https://www.exploit-db.com/exploits/46630 and https://www.vulncheck.com/advisories/inout-easyrooms-ultimate-edition-sql-injection-via-search. No specific patches or mitigation steps are described in the provided information.