CVE-2019-25580

HighPublic PoC

Published: 21 March 2026

Published

21 March 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0006 19.5th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25580 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Owndms Owndms. Its CVSS base score is 8.2 (High).

Operationally, ranked at the 19.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly requires validating and sanitizing the IMG parameter in pdfstream.php, imagestream.php, and anyfilestream.php to prevent SQL injection payloads.

SI-2 Flaw Remediation good match

prevent

Mandates timely identification, reporting, and correction of the SQL injection flaw, eliminating the vulnerability through patching or code fixes.

RA-5 Vulnerability Monitoring and Scanning good match

detect

Requires vulnerability scanning that would identify the SQL injection vulnerability in ownDMS 4.7 for prioritization and remediation.

NVD Description

ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the…

IMG parameter to extract sensitive database information including version and database names.

Deeper analysisAI

CVE-2019-25580 is an SQL injection vulnerability (CWE-434) affecting ownDMS version 4.7. The flaw resides in the pdfstream.php, imagestream.php, and anyfilestream.php scripts, where the IMG parameter fails to properly sanitize user input, allowing injection of malicious SQL code. Published on 2026-03-21, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with no privileges or user interaction required.

Unauthenticated remote attackers can exploit the vulnerability by sending GET requests to the affected endpoints with crafted SQL payloads in the IMG parameter. Successful exploitation enables execution of arbitrary SQL queries, permitting extraction of sensitive database information such as database versions and names.

Advisories, including those from Vulncheck and an Exploit-DB entry (ID 46168), document the issue and provide proof-of-concept exploits. References point to the ownDMS website and a download link for version 4.7, but no patches or vendor-specific mitigations are detailed.

A public exploit is available on Exploit-DB, suggesting potential for real-world abuse against unpatched ownDMS 4.7 deployments.