CVE-2019-25636
Published: 24 March 2026
Summary
CVE-2019-25636 is a high-severity SQL Injection (CWE-89) vulnerability in Zeeways Jobsite Cms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Zeeways Jobsite CMS is affected by CVE-2019-25636, an SQL injection vulnerability (CWE-89) that enables attackers to manipulate database queries through the 'id' GET parameter. The flaw exists in the files news_details.php, jobs_details.php, and job_cmp_details.php, where insufficient input sanitization allows injection of SQL code, such as GROUP BY and CASE statements, to extract sensitive database information. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low complexity and no privileges required.
Unauthenticated remote attackers can exploit this vulnerability by sending crafted HTTP GET requests to the affected endpoints with malicious 'id' values. Successful exploitation allows extraction of sensitive data from the database, such as user credentials, job listings, or other confidential information, potentially leading to further compromise depending on the database contents and application configuration.
Advisories and related resources are available at the vendor's product page (http://www.zeeways.com/jobsite-cms/1/productdetail), an Exploit-DB entry (https://www.exploit-db.com/exploits/46602) detailing a proof-of-concept, and a Vulncheck advisory (https://www.vulncheck.com/advisories/zeeways-jobsite-cms-lastest-sql-injection-via-id-parameter). Practitioners should review these for any patch information or mitigation guidance, as no specific fixes are detailed in the CVE description.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20013
Vulnerability details
Zeeways Jobsite CMS contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' GET parameter. Attackers can send crafted requests to news_details.php, jobs_details.php, or job_cmp_details.php with malicious 'id' values using…
more
GROUP BY and CASE statements to extract sensitive database information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated SQL injection in public-facing CMS web endpoints enables remote exploitation of the application for data extraction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation of untrusted inputs like the 'id' GET parameter in the affected PHP files.
SI-2 ensures timely remediation of the specific SQL injection flaw in news_details.php, jobs_details.php, and job_cmp_details.php.
SI-9 restricts the 'id' parameter to expected formats such as integers, blocking SQL code injections using GROUP BY and CASE statements.