CVE-2019-25580
Published: 21 March 2026
Summary
CVE-2019-25580 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Owndms Owndms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25580 is an SQL injection vulnerability (CWE-434) affecting ownDMS version 4.7. The flaw resides in the pdfstream.php, imagestream.php, and anyfilestream.php scripts, where the IMG parameter fails to properly sanitize user input, allowing injection of malicious SQL code. Published on 2026-03-21, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with no privileges or user interaction required.
Unauthenticated remote attackers can exploit the vulnerability by sending GET requests to the affected endpoints with crafted SQL payloads in the IMG parameter. Successful exploitation enables execution of arbitrary SQL queries, permitting extraction of sensitive database information such as database versions and names.
Advisories, including those from Vulncheck and an Exploit-DB entry (ID 46168), document the issue and provide proof-of-concept exploits. References point to the ownDMS website and a download link for version 4.7, but no patches or vendor-specific mitigations are detailed.
A public exploit is available on Exploit-DB, suggesting potential for real-world abuse against unpatched ownDMS 4.7 deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19903
Vulnerability details
ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the…
more
IMG parameter to extract sensitive database information including version and database names.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing PHP scripts directly enables remote exploitation of internet-facing applications to extract database contents.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validating and sanitizing the IMG parameter in pdfstream.php, imagestream.php, and anyfilestream.php to prevent SQL injection payloads.
Mandates timely identification, reporting, and correction of the SQL injection flaw, eliminating the vulnerability through patching or code fixes.
Requires vulnerability scanning that would identify the SQL injection vulnerability in ownDMS 4.7 for prioritization and remediation.