CVE-2019-25640
Published: 24 March 2026
Summary
CVE-2019-25640 is a high-severity SQL Injection (CWE-89) vulnerability in Inoutscripts (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25640 is an SQL injection vulnerability (CWE-89) in Inout Article Base CMS, affecting the portalLogin.php component. The flaw arises from insufficient sanitization of the 'p' and 'u' parameters in GET requests, enabling attackers to manipulate database queries with XOR-based payloads. Published on 2026-03-24, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility and confidentiality risks.
Unauthenticated remote attackers can exploit this vulnerability by sending crafted GET requests to portalLogin.php. Successful exploitation allows extraction of sensitive database information or denial of service via time-based blind SQL injection techniques, with low attack complexity and no user interaction required.
Advisories and proof-of-concept exploits detail the issue, including an Exploit-DB entry at https://www.exploit-db.com/exploits/46593, the vendor product page at https://www.inoutscripts.com/products/inout-article-base/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/inout-article-base-cms-lastest-sql-injection-via-portallogin-php. Practitioners should consult these for detection signatures, patch availability, or upgrade guidance from the vendor.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20020
Vulnerability details
Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters. Attackers can inject SQL code using XOR-based payloads in GET requests to portalLogin.php to extract sensitive database information…
more
or cause denial of service through time-based attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (portalLogin.php) directly enables exploitation of public-facing application (T1190) and facilitates data collection from databases via query manipulation (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation and sanitization of untrusted inputs like the 'p' and 'u' GET parameters in portalLogin.php to directly prevent SQL injection exploitation.
Requires timely remediation of identified flaws, such as patching CVE-2019-25640 in Inout Article Base CMS to eliminate the SQL injection vulnerability.
Implements boundary protection mechanisms like web application firewalls to inspect and block malicious SQL injection payloads in network traffic to portalLogin.php.