CVE-2019-25642
Published: 24 March 2026
Summary
CVE-2019-25642 is a high-severity SQL Injection (CWE-89) vulnerability in Bootstrapy CMS (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25642 describes multiple SQL injection vulnerabilities (CWE-89) in Bootstrapy CMS, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). These flaws affect specific PHP endpoints where POST parameters are not properly sanitized: the thread_id parameter in forum-thread.php, the subject parameter in contact-submit.php, the post-id parameter in post-new-submit.php, and the thread-id parameter in an additional context.
Unauthenticated remote attackers can exploit these vulnerabilities by injecting arbitrary SQL payloads through the vulnerable POST parameters, enabling execution of malicious queries. Successful exploitation allows extraction of sensitive database information or denial of service, with high confidentiality impact, low integrity impact, and no availability impact per the CVSS vector.
Advisories, including those from Vulncheck detailing SQL injection via forum and contact modules, and an Exploit-DB entry (46590) providing proof-of-concept code, highlight the issues but do not specify patches or vendor-provided mitigations in the available references. The Bootstrapy CMS site (bootstrapy.com) is referenced as the primary source.
A public exploit on Exploit-DB indicates potential for real-world abuse against unpatched Bootstrapy CMS instances.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20024
Vulnerability details
Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can inject SQL payloads into the thread_id parameter of forum-thread.php, the subject parameter of contact-submit.php, the…
more
post-id parameter of post-new-submit.php, and the thread-id parameter to extract sensitive database information or cause denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes unauthenticated SQL injection in public-facing Bootstrapy CMS endpoints, directly enabling T1190 (Exploit Public-Facing Application) for initial access and T1213.006 (Databases) for extracting sensitive database information via malicious SQL queries.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing vulnerable POST parameters like thread_id and subject before processing database queries.
Requires timely identification, reporting, and patching of the SQL injection flaws in Bootstrapy CMS PHP endpoints such as forum-thread.php.
Boundary protection mechanisms like web application firewalls can inspect and block malicious SQL payloads in unauthenticated POST requests.