CVE-2019-25578
Published: 21 March 2026
Summary
CVE-2019-25578 is a high-severity SQL Injection (CWE-89) vulnerability in Codnloc Phptransformer. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25578 is an SQL injection vulnerability in phpTransformer version 2016.9, specifically affecting the GeneratePDF.php component. The flaw arises from unsanitized user input in the idnews parameter, enabling remote attackers to inject and execute arbitrary SQL queries against the underlying database.
Unauthenticated remote attackers can exploit this vulnerability by sending crafted GET requests to GeneratePDF.php with malicious SQL payloads in the idnews parameter. Successful exploitation allows extraction of sensitive database information or manipulation of queries, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact, low integrity impact, and no availability impact.
Advisories and references, including an Exploit-DB proof-of-concept at https://www.exploit-db.com/exploits/46191 and a Vulncheck advisory at https://www.vulncheck.com/advisories/phptransformer-sql-injection-via-generatepdf-php, document the issue but provide no details on official patches or mitigations in the available information. The phpTransformer homepage at http://phptransformer.com/ and a direct download link for version 2016.9 are also referenced.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19901
Vulnerability details
phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to GeneratePDF.php with SQL payloads in the idnews parameter to…
more
extract sensitive database information or manipulate queries.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct SQL injection in public-facing GeneratePDF.php enables remote unauthenticated exploitation of the web app for data access/manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validating unsanitized user inputs like the idnews parameter in GeneratePDF.php to block SQL injection payloads.
Mandates timely identification, reporting, and correction of the SQL injection flaw in phpTransformer 2016.9.
Enables continuous monitoring of system and network activities to identify SQL injection exploitation attempts via anomalous queries or data access patterns.