Cyber Resilience

CVE-2019-25680

HighPublic PoC

Published: 05 April 2026

Published
05 April 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0040 31.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25680 is a high-severity SQL Injection (CWE-89) vulnerability in Phpscriptsmall Advance Gift Shop Pro Script. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25680 is an SQL injection vulnerability (CWE-89) affecting Advance Gift Shop Pro Script version 2.0.3. The issue arises in the search functionality, where the 's' parameter does not properly sanitize user input, enabling attackers to inject malicious SQL code and execute arbitrary SQL queries against the underlying database.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required, as reflected in its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Exploitation allows extraction of sensitive database information, including version details and other data, primarily impacting confidentiality with high severity while having low integrity impact and no availability impact.

Reference advisories and resources include the vendor site at http://www.phpscriptsmall.com/, a proof-of-concept exploit at https://www.exploit-db.com/exploits/46457, and a VulnCheck advisory at https://www.vulncheck.com/advisories/advance-gift-shop-pro-script-sql-injection-via-search; no specific patch or mitigation guidance is detailed in the CVE description.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Advance Gift Shop Pro Script 2.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can submit crafted SQL payloads in the 's' parameter of search…

more

requests to extract sensitive database information including version details and other data.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing web application enables exploitation of public-facing application (T1190) and extraction of data from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-25444Same vendor: Phpscriptsmall
CVE-2019-25676Same vendor: Phpscriptsmall
CVE-2019-25668Same vendor: Phpscriptsmall
CVE-2018-25199Shared CWE-89
CVE-2026-27179Shared CWE-89
CVE-2025-0308Shared CWE-89
CVE-2019-25581Shared CWE-89
CVE-2026-27885Shared CWE-89
CVE-2019-25479Shared CWE-89
CVE-2026-1476Shared CWE-89

Affected Assets

phpscriptsmall
advance gift shop pro script
≤ 2.0.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly prevents SQL injection attacks like CVE-2019-25680 by validating and sanitizing the unsanitized 's' search parameter to block malicious SQL payloads.

prevent

Addresses the specific SQL injection flaw in Advance Gift Shop Pro Script 2.0.3 by requiring timely identification, testing, and installation of patches or updates.

preventdetect

Detects the SQL injection vulnerability through regular scanning of web applications and hosted scripts, enabling remediation before exploitation.

References