Cyber Posture

CVE-2019-25433

HighPublic PoC

Published: 22 February 2026

Published
22 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0013 31.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

XOOPS CMS 2.5.9 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter. Attackers can send GET requests to the gerar_pdf.php endpoint with malicious cid values to extract sensitive…

more

database information.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly addresses the root cause by requiring validation and sanitization of user inputs like the 'cid' parameter to block SQL injection in database queries.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and correction of the specific SQL injection flaw in the gerar_pdf.php endpoint of XOOPS CMS 2.5.9.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Requires vulnerability scanning to proactively identify the SQL injection vulnerability (CWE-89) via tools that test the 'cid' parameter in gerar_pdf.php.

Security SummaryAI

CVE-2019-25433 is an SQL injection vulnerability (CWE-89) in XOOPS CMS version 2.5.9. The flaw resides in the gerar_pdf.php endpoint, where the cid parameter fails to properly sanitize user input, allowing attackers to inject arbitrary SQL code into database queries.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. By sending crafted GET requests containing malicious values in the cid parameter, they can manipulate database queries to extract sensitive information. The CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects high confidentiality impact with low integrity impact and no availability impact.

Advisories and additional details are available from sources including Exploit-DB (which hosts a public exploit at https://www.exploit-db.com/exploits/46835), VulnCheck (https://www.vulncheck.com/advisories/xoops-cms-sql-injection-via-gerarpdfphp), and the official XOOPS site (https://xoops.org/). These references provide exploit code and vulnerability analysis, though specific patch information is not detailed in the CVE description.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web endpoint (gerar_pdf.php) enables T1190 (Exploit Public-Facing Application). Allows arbitrary database queries for data extraction, facilitating T1213.006 (Data from Information Repositories: Databases).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References