CVE-2019-25674
Published: 05 April 2026
Summary
CVE-2019-25674 is a high-severity SQL Injection (CWE-89) vulnerability in Victoralagwu Cmssite. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25674 is an SQL injection vulnerability (CWE-89) affecting CMSsite version 1.0. The issue occurs in the post.php component, where the 'post' parameter in GET requests fails to properly sanitize input, enabling attackers to inject arbitrary SQL code and manipulate database queries.
Unauthenticated remote attackers can exploit this vulnerability with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By crafting malicious 'post' parameter values in GET requests to post.php, attackers can extract sensitive database information or perform time-based blind SQL injection attacks, resulting in high confidentiality impact and low integrity impact.
Advisories from Vulncheck and an Exploit-DB entry (exploit 46402) describe the vulnerability and include proof-of-concept exploits demonstrating the SQL injection via the 'post' parameter. The CMSsite GitHub repository serves as the source for the affected software, though no patches or specific mitigations are detailed in the referenced materials.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20083
Vulnerability details
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or…
more
perform time-based blind SQL injection attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing CMS web application (post.php) enables exploitation of public-facing application (T1190) and extraction of sensitive data from databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the SQL injection vulnerability by requiring validation and sanitization of the untrusted 'post' parameter in post.php to block malicious SQL code injection.
Requires timely identification, reporting, and remediation of the specific SQL injection flaw in post.php, preventing attacker exploitation of database queries.
Enforces boundary protection via web application firewalls or proxies to inspect and block SQL injection payloads in unauthenticated GET requests to post.php.