Cyber Resilience

CVE-2019-25536

HighPublic PoC

Published: 12 March 2026

Published
12 March 2026
Modified
07 April 2026
KEV Added
—
Patch
—
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0032 23.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25536 is a high-severity SQL Injection (CWE-89) vulnerability in Netartmedia Real Estate Portal. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25536 is an SQL injection vulnerability (CWE-89) affecting Netartmedia PHP Real Estate Agency version 4.0. The issue arises in the features[] parameter handled by index.php, where the application fails to properly sanitize user input, allowing attackers to inject and execute arbitrary SQL queries.

Unauthenticated remote attackers can exploit this vulnerability by sending POST requests to index.php with crafted SQL payloads in the features[] parameter. Exploitation enables extraction of sensitive database information or manipulation of database queries, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact and low integrity impact.

Advisories from VulnCheck (https://www.vulncheck.com/advisories/netartmedia-php-real-estate-agency-sql-injection-via-features-parameter) and an Exploit-DB entry (https://www.exploit-db.com/exploits/46574) document the vulnerability and provide proof-of-concept details.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can send POST requests to index.php with crafted SQL payloads in…

more

the features[] parameter to extract sensitive database information or manipulate database queries.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct unauthenticated remote exploitation of a public-facing web application via SQL injection in index.php.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-25542Same product: Netartmedia Real Estate Portal
CVE-2019-25543Same product: Netartmedia Real Estate Portal
CVE-2019-25540Same vendor: Netartmedia
CVE-2019-25541Same vendor: Netartmedia
CVE-2026-24956Shared CWE-89
CVE-2026-33615Shared CWE-89
CVE-2025-28939Shared CWE-89
CVE-2021-47872Shared CWE-89
CVE-2025-28873Shared CWE-89
CVE-2019-25636Shared CWE-89

Affected Assets

netartmedia
real estate portal
4.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates the SQL injection by requiring validation and sanitization of the features[] parameter to block malicious SQL payloads.

SI-9 Information Input Restrictions good match
prevent

Restricts the features[] input to authorized types, formats, and values, preventing injection of arbitrary SQL queries via POST requests.

SI-2 Flaw Remediation good match
prevent

Requires timely identification and remediation of the SQL injection flaw in index.php, eliminating the vulnerability through patching or code fixes.

References