Cyber Posture

CVE-2019-25440

HighPublic PoC

Published: 22 February 2026

Published
22 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0013 32.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

WebIncorp ERP contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the prod_id parameter. Attackers can send GET requests to product_detail.php with malicious prod_id values to extract sensitive database information.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection by requiring validation of the prod_id parameter to ensure only legitimate inputs reach database queries.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on the prod_id parameter, such as limiting to numeric values or whitelisting, to block malicious SQL code injection.

SI-2 Flaw Remediation partial match
prevent

Addresses the vulnerability by requiring identification, reporting, and correction of the SQL injection flaw in product_detail.php.

Security SummaryAI

CVE-2019-25440 is an SQL injection vulnerability in WebIncorp ERP, affecting the product_detail.php component. The flaw allows attackers to inject SQL code through the prod_id parameter in GET requests, enabling manipulation of database queries. It is classified under CWE-89 with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact, low integrity impact, and no availability impact. The vulnerability was published on 2026-02-22.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted GET requests to product_detail.php with malicious values in the prod_id parameter. Successful exploitation allows extraction of sensitive database information, such as user credentials or other confidential data stored in the backend database.

Advisories confirm the issue affects every version of WebIncorp ERP, with proof-of-concept exploits documented on Exploit-DB (exploit 47199) and detailed in VulnCheck's advisory on the SQL injection via product_detail.php. No patches or specific mitigations are detailed in the provided references.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web application enables exploitation of remote services (T1190) and data collection from databases (T1213.006) via arbitrary query manipulation for sensitive information extraction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References