CVE-2019-25578

HighPublic PoC

Published: 21 March 2026

Published

21 March 2026

Modified

26 March 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0006 17.3th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25578 is a high-severity SQL Injection (CWE-89) vulnerability in Codnloc Phptransformer. Its CVSS base score is 8.2 (High).

Operationally, ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly requires validating unsanitized user inputs like the idnews parameter in GeneratePDF.php to block SQL injection payloads.

SI-2 Flaw Remediation good match

prevent

Mandates timely identification, reporting, and correction of the SQL injection flaw in phpTransformer 2016.9.

SI-4 System Monitoring good match

detect

Enables continuous monitoring of system and network activities to identify SQL injection exploitation attempts via anomalous queries or data access patterns.

NVD Description

phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to GeneratePDF.php with SQL payloads in the idnews parameter to…

extract sensitive database information or manipulate queries.

Deeper analysisAI

CVE-2019-25578 is an SQL injection vulnerability in phpTransformer version 2016.9, specifically affecting the GeneratePDF.php component. The flaw arises from unsanitized user input in the idnews parameter, enabling remote attackers to inject and execute arbitrary SQL queries against the underlying database.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted GET requests to GeneratePDF.php with malicious SQL payloads in the idnews parameter. Successful exploitation allows extraction of sensitive database information or manipulation of queries, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact, low integrity impact, and no availability impact.

Advisories and references, including an Exploit-DB proof-of-concept at https://www.exploit-db.com/exploits/46191 and a Vulncheck advisory at https://www.vulncheck.com/advisories/phptransformer-sql-injection-via-generatepdf-php, document the issue but provide no details on official patches or mitigations in the available information. The phpTransformer homepage at http://phptransformer.com/ and a direct download link for version 2016.9 are also referenced.