Cyber Resilience

CVE-2019-25642

HighPublic PoC

Published: 24 March 2026

Published
24 March 2026
Modified
01 May 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0027 18.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25642 is a high-severity SQL Injection (CWE-89) vulnerability in Bootstrapy CMS (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25642 describes multiple SQL injection vulnerabilities (CWE-89) in Bootstrapy CMS, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). These flaws affect specific PHP endpoints where POST parameters are not properly sanitized: the thread_id parameter in forum-thread.php, the subject parameter in contact-submit.php, the post-id parameter in post-new-submit.php, and the thread-id parameter in an additional context.

Unauthenticated remote attackers can exploit these vulnerabilities by injecting arbitrary SQL payloads through the vulnerable POST parameters, enabling execution of malicious queries. Successful exploitation allows extraction of sensitive database information or denial of service, with high confidentiality impact, low integrity impact, and no availability impact per the CVSS vector.

Advisories, including those from Vulncheck detailing SQL injection via forum and contact modules, and an Exploit-DB entry (46590) providing proof-of-concept code, highlight the issues but do not specify patches or vendor-provided mitigations in the available references. The Bootstrapy CMS site (bootstrapy.com) is referenced as the primary source.

A public exploit on Exploit-DB indicates potential for real-world abuse against unpatched Bootstrapy CMS instances.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can inject SQL payloads into the thread_id parameter of forum-thread.php, the subject parameter of contact-submit.php, the…

more

post-id parameter of post-new-submit.php, and the thread-id parameter to extract sensitive database information or cause denial of service.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

CVE describes unauthenticated SQL injection in public-facing Bootstrapy CMS endpoints, directly enabling T1190 (Exploit Public-Facing Application) for initial access and T1213.006 (Databases) for extracting sensitive database information via malicious SQL queries.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2018-25199Shared CWE-89
CVE-2026-27179Shared CWE-89
CVE-2025-0308Shared CWE-89
CVE-2019-25581Shared CWE-89
CVE-2026-27885Shared CWE-89
CVE-2019-25479Shared CWE-89
CVE-2026-1476Shared CWE-89
CVE-2019-25526Shared CWE-89
CVE-2025-69365Shared CWE-89
CVE-2019-25573Shared CWE-89

Affected Assets

Bootstrapy
CMS
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly prevents SQL injection by validating and sanitizing vulnerable POST parameters like thread_id and subject before processing database queries.

prevent

Requires timely identification, reporting, and patching of the SQL injection flaws in Bootstrapy CMS PHP endpoints such as forum-thread.php.

prevent

Boundary protection mechanisms like web application firewalls can inspect and block malicious SQL payloads in unauthenticated POST requests.

References