Cyber Resilience

CVE-2019-25674

HighPublic PoC

Published: 05 April 2026

Published
05 April 2026
Modified
09 April 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0040 32.2th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25674 is a high-severity SQL Injection (CWE-89) vulnerability in Victoralagwu Cmssite. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25674 is an SQL injection vulnerability (CWE-89) affecting CMSsite version 1.0. The issue occurs in the post.php component, where the 'post' parameter in GET requests fails to properly sanitize input, enabling attackers to inject arbitrary SQL code and manipulate database queries.

Unauthenticated remote attackers can exploit this vulnerability with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By crafting malicious 'post' parameter values in GET requests to post.php, attackers can extract sensitive database information or perform time-based blind SQL injection attacks, resulting in high confidentiality impact and low integrity impact.

Advisories from Vulncheck and an Exploit-DB entry (exploit 46402) describe the vulnerability and include proof-of-concept exploits demonstrating the SQL injection via the 'post' parameter. The CMSsite GitHub repository serves as the source for the affected software, though no patches or specific mitigations are detailed in the referenced materials.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or…

more

perform time-based blind SQL injection attacks.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing CMS web application (post.php) enables exploitation of public-facing application (T1190) and extraction of sensitive data from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-25697Same product: Victoralagwu Cmssite
CVE-2018-25199Shared CWE-89
CVE-2026-27179Shared CWE-89
CVE-2025-0308Shared CWE-89
CVE-2019-25581Shared CWE-89
CVE-2026-27885Shared CWE-89
CVE-2019-25479Shared CWE-89
CVE-2026-1476Shared CWE-89
CVE-2019-25526Shared CWE-89
CVE-2025-69365Shared CWE-89

Affected Assets

victoralagwu
cmssite
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mitigates the SQL injection vulnerability by requiring validation and sanitization of the untrusted 'post' parameter in post.php to block malicious SQL code injection.

prevent

Requires timely identification, reporting, and remediation of the specific SQL injection flaw in post.php, preventing attacker exploitation of database queries.

prevent

Enforces boundary protection via web application firewalls or proxies to inspect and block SQL injection payloads in unauthenticated GET requests to post.php.

References