CVE-2019-25530

HighPublic PoC

Published: 12 March 2026

Published

12 March 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0034 25.2th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25530 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25530 is an SQL injection vulnerability (CWE-89) in the uHotelBooking System, published on 2026-03-12. The flaw resides in the system_page GET parameter within index.php, where attackers can inject SQL code to manipulate database queries. It enables time-based blind SQL injection techniques through crafted requests, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. By sending specially crafted HTTP GET requests to index.php with malicious values in the system_page parameter, they can extract sensitive database information, achieving high confidentiality impact alongside low integrity impact and no availability disruption.

Advisories and exploit details are documented in references including Exploit-DB (https://www.exploit-db.com/exploits/46587) and a Vulncheck advisory (https://www.vulncheck.com/advisories/uhotelbooking-system-lastest-sql-injection-via-system-page-parameter), which cover the SQL injection via the system_page parameter.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-19812

Vulnerability details

uHotelBooking System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the system_page GET parameter. Attackers can send crafted requests to index.php with malicious system_page values using time-based blind SQL injection…

techniques to extract sensitive database information.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

CVE-2019-25530 is an unauthenticated SQL injection in a public-facing web application (uHotelBooking index.php), directly enabling T1190 (Exploit Public-Facing Application). It facilitates blind SQLi for extracting sensitive database information, mapping to T1213.006 (Data from Information Repositories: Databases).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0