Cyber Resilience

CVE-2019-25669

HighPublic PoC

Published: 05 April 2026

Published
05 April 2026
Modified
09 April 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0031 22.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25669 is a high-severity SQL Injection (CWE-89) vulnerability in Qdpm Qdpm. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25669 is an SQL injection vulnerability (CWE-89) affecting qdPM version 9.1, a project management software. The issue resides in the handling of the search_by_extrafields[] parameter, which allows attackers to inject malicious SQL code via POST requests to the users endpoint. This manipulation of database queries can trigger SQL syntax errors, facilitating the extraction of sensitive database information.

The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), making it exploitable over the network by unauthenticated attackers with low attack complexity and no user interaction required. Successful exploitation enables high-impact confidentiality breaches, such as unauthorized data disclosure from the database, alongside limited integrity modifications but no denial-of-service effects.

References include the official qdPM site (http://qdpm.net) and its download page (http://qdpm.net/download-qdpm-free-project-management), an Exploit-DB proof-of-concept (https://www.exploit-db.com/exploits/46387), and a VulnCheck advisory detailing the SQL injection via the search_by_extrafields parameter (https://www.vulncheck.com/advisories/qdpm-sql-injection-via-search-by-extrafields-parameter). Security practitioners should review these sources for any available patches or mitigation guidance.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to trigger SQL syntax errors…

more

and extract database information.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct unauthenticated SQL injection in a public-facing web application (qdPM) enabling database data extraction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24956Shared CWE-89
CVE-2026-33615Shared CWE-89
CVE-2025-28939Shared CWE-89
CVE-2021-47872Shared CWE-89
CVE-2025-28873Shared CWE-89
CVE-2019-25636Shared CWE-89
CVE-2026-32611Shared CWE-89
CVE-2026-42755Shared CWE-89
CVE-2024-53544Shared CWE-89
CVE-2026-21410Shared CWE-89

Affected Assets

qdpm
qdpm
≤ 9.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-10 requires validation and sanitization of inputs like search_by_extrafields[], directly preventing SQL injection attacks from manipulating database queries.

prevent

SI-2 mandates identifying, reporting, and correcting flaws such as this SQL injection vulnerability through timely patching of qdPM 9.1.

prevent

SI-11 ensures error messages from SQL syntax errors do not reveal exploitable database information, limiting the impact of error-based extraction attempts.

References