CVE-2019-25672
Published: 05 April 2026
Summary
CVE-2019-25672 is a high-severity SQL Injection (CWE-89) vulnerability in Kartatopia Piluscart. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
PilusCart 1.4.1 is affected by CVE-2019-25672, a SQL injection vulnerability (CWE-89) in the comment submission endpoint. The flaw allows attackers to inject SQL code through the 'send' parameter, enabling manipulation of database queries. It has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact.
Unauthenticated remote attackers can exploit this vulnerability by submitting POST requests containing RLIKE-based boolean SQL injection payloads to the comment submission endpoint. Successful exploitation allows extraction of sensitive database information without requiring user interaction or privileges.
Advisories and related resources include the PilusCart project page on SourceForge, an Exploit-DB entry (46368) detailing the exploit, and a VulnCheck advisory on the SQL injection via the 'send' parameter. No specific patches or mitigation steps are detailed in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20079
Vulnerability details
PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'send' parameter. Attackers can submit POST requests to the comment submission endpoint with RLIKE-based boolean SQL injection payloads to…
more
extract sensitive database information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app endpoint directly enables T1190 exploitation for unauthenticated remote access; successful payload use facilitates T1213 data retrieval from backend database repository.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing the 'send' parameter before it is used in database queries at the comment submission endpoint.
Remediates the root cause of the SQL injection vulnerability through timely patching or code fixes for PilusCart 1.4.1.
Deploys boundary protections such as web application firewalls to inspect and block RLIKE-based SQL injection payloads in unauthenticated POST requests.