CVE-2019-25533

HighPublic PoC

Published: 12 March 2026

Published

12 March 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0030 22.0th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25533 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25533 is an SQL injection vulnerability (CWE-89) affecting Netartmedia PHP Business Directory version 4.2. The issue occurs in the loginaction.php endpoint, where the Email parameter is vulnerable to manipulation, enabling attackers to inject SQL code into database queries.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges or user interaction required, earning it a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By sending POST requests to loginaction.php with crafted SQL payloads in the Email field, attackers can extract sensitive database information or bypass authentication.

Details on the vulnerability, including an exploit, are documented in references such as https://www.exploit-db.com/exploits/46577 and https://www.vulncheck.com/advisories/netartmedia-php-business-directory-sql-injection-via-loginaction-php.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-19815

Vulnerability details

Netartmedia PHP Business Directory 4.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to the loginaction.php endpoint with crafted SQL payloads in…

the Email field to extract sensitive database information or bypass authentication.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing web application (loginaction.php) enables exploitation of public-facing application (T1190) and extraction of sensitive data from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0