CVE-2019-25431
Published: 20 February 2026
Description
delpino73 Blue-Smiley-Organizer 1.32 contains an SQL injection vulnerability in the datetime parameter that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through POST requests to extract sensitive data using boolean-based blind and time-based blind techniques, or…
more
write files to the server using INTO OUTFILE statements.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the datetime parameter input to block SQL injection payloads before they reach the database query.
Mandates identification, prioritization, and remediation of the SQL injection flaw, preventing exploitation of this specific CVE.
Enables monitoring for indicators of SQL injection attacks, such as anomalous database queries or blind technique patterns.
Security SummaryAI
CVE-2019-25431 is an SQL injection vulnerability affecting delpino73 Blue-Smiley-Organizer version 1.32, specifically in the datetime parameter. This flaw allows attackers to manipulate database queries by injecting SQL code through POST requests. The vulnerability is classified under CWE-89 and carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By leveraging boolean-based blind and time-based blind techniques, they can extract sensitive data from the database. Additionally, attackers can use INTO OUTFILE statements to write files to the server.
Advisories and related resources, including the project GitHub repository at https://github.com/delpino73/Blue-Smiley-Organizer, an Exploit-DB entry at https://www.exploit-db.com/exploits/47550, and a Vulncheck advisory at https://www.vulncheck.com/advisories/delpino-blue-smiley-organizer-sql-injection-via-datetime, provide further details on the issue. No specific patch or mitigation guidance is detailed in the available information.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (T1190) enables unauthenticated remote data extraction from databases (T1213.006) via blind techniques and file writes via INTO OUTFILE.