CVE-2019-25527

HighPublic PoC

Published: 12 March 2026

Published

12 March 2026

Modified

19 March 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0041 32.5th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25527 is a high-severity SQL Injection (CWE-89) vulnerability in Inoutscripts Inout Homestay. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25527 is an SQL injection vulnerability (CWE-89) in Inout EasyRooms Ultimate Edition v1.0. The flaw resides in the search/searchdetailed endpoint, where the numguest parameter fails to properly sanitize user input, allowing attackers to inject arbitrary SQL code and manipulate database queries.

Unauthenticated remote attackers can exploit this vulnerability with low complexity by sending crafted POST requests containing malicious SQL payloads to the affected endpoint. Successful exploitation enables bypassing authentication, extracting sensitive data from the database, or modifying database contents, as indicated by the CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), which reflects high confidentiality impact and low integrity impact.

Advisories from VulnCheck and an Exploit-DB entry (exploit 46630) document the vulnerability, including proof-of-concept details for the SQL injection via the numguest parameter. No specific patches or mitigation steps are detailed in the CVE information provided.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-19809

Vulnerability details

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the numguest parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads to…

bypass authentication, extract sensitive data, or modify database contents.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing web application endpoint directly enables exploitation of public-facing apps (T1190) and data extraction/modification from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0