Cyber Resilience

CVE-2019-25636

HighPublic PoC

Published: 24 March 2026

Published
24 March 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0033 24.3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25636 is a high-severity SQL Injection (CWE-89) vulnerability in Zeeways Jobsite Cms. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

Zeeways Jobsite CMS is affected by CVE-2019-25636, an SQL injection vulnerability (CWE-89) that enables attackers to manipulate database queries through the 'id' GET parameter. The flaw exists in the files news_details.php, jobs_details.php, and job_cmp_details.php, where insufficient input sanitization allows injection of SQL code, such as GROUP BY and CASE statements, to extract sensitive database information. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low complexity and no privileges required.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted HTTP GET requests to the affected endpoints with malicious 'id' values. Successful exploitation allows extraction of sensitive data from the database, such as user credentials, job listings, or other confidential information, potentially leading to further compromise depending on the database contents and application configuration.

Advisories and related resources are available at the vendor's product page (http://www.zeeways.com/jobsite-cms/1/productdetail), an Exploit-DB entry (https://www.exploit-db.com/exploits/46602) detailing a proof-of-concept, and a Vulncheck advisory (https://www.vulncheck.com/advisories/zeeways-jobsite-cms-lastest-sql-injection-via-id-parameter). Practitioners should review these for any patch information or mitigation guidance, as no specific fixes are detailed in the CVE description.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Zeeways Jobsite CMS contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' GET parameter. Attackers can send crafted requests to news_details.php, jobs_details.php, or job_cmp_details.php with malicious 'id' values using…

more

GROUP BY and CASE statements to extract sensitive database information.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct unauthenticated SQL injection in public-facing CMS web endpoints enables remote exploitation of the application for data extraction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-25635Same vendor: Zeeways
CVE-2026-24956Shared CWE-89
CVE-2026-33615Shared CWE-89
CVE-2025-28939Shared CWE-89
CVE-2021-47872Shared CWE-89
CVE-2025-28873Shared CWE-89
CVE-2026-32611Shared CWE-89
CVE-2026-42755Shared CWE-89
CVE-2024-53544Shared CWE-89
CVE-2026-21410Shared CWE-89

Affected Assets

zeeways
jobsite cms
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-10 directly prevents SQL injection by requiring validation of untrusted inputs like the 'id' GET parameter in the affected PHP files.

prevent

SI-2 ensures timely remediation of the specific SQL injection flaw in news_details.php, jobs_details.php, and job_cmp_details.php.

prevent

SI-9 restricts the 'id' parameter to expected formats such as integers, blocking SQL code injections using GROUP BY and CASE statements.

References