CVE-2019-25536

HighPublic PoC

Published: 12 March 2026

Published

12 March 2026

Modified

07 April 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0009 25.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25536 is a high-severity SQL Injection (CWE-89) vulnerability in Netartmedia Real Estate Portal. Its CVSS base score is 8.2 (High).

Operationally, ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates the SQL injection by requiring validation and sanitization of the features[] parameter to block malicious SQL payloads.

SI-9 Information Input Restrictions good match

prevent

Restricts the features[] input to authorized types, formats, and values, preventing injection of arbitrary SQL queries via POST requests.

SI-2 Flaw Remediation good match

prevent

Requires timely identification and remediation of the SQL injection flaw in index.php, eliminating the vulnerability through patching or code fixes.

NVD Description

Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can send POST requests to index.php with crafted SQL payloads in…

the features[] parameter to extract sensitive database information or manipulate database queries.

Deeper analysisAI

CVE-2019-25536 is an SQL injection vulnerability (CWE-89) affecting Netartmedia PHP Real Estate Agency version 4.0. The issue arises in the features[] parameter handled by index.php, where the application fails to properly sanitize user input, allowing attackers to inject and execute arbitrary SQL queries.

Unauthenticated remote attackers can exploit this vulnerability by sending POST requests to index.php with crafted SQL payloads in the features[] parameter. Exploitation enables extraction of sensitive database information or manipulation of database queries, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact and low integrity impact.

Advisories from VulnCheck (https://www.vulncheck.com/advisories/netartmedia-php-real-estate-agency-sql-injection-via-features-parameter) and an Exploit-DB entry (https://www.exploit-db.com/exploits/46574) document the vulnerability and provide proof-of-concept details.