Cyber Posture

CVE-2019-25443

HighPublic PoC

Published: 22 February 2026

Published
22 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0013 32.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Inventory Webapp contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can supply malicious SQL payloads in the name, description, quantity, or cat_id parameters to add-item.php to execute…

more

arbitrary database commands.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents SQL injection by validating and sanitizing untrusted GET parameters (name, description, quantity, cat_id) before use in database queries.

prevent

Ensures timely identification, reporting, and correction of the SQL injection flaw in add-item.php to eliminate the vulnerability.

detect

Detects the SQL injection vulnerability through regular vulnerability scanning of the web application, enabling remediation.

Security SummaryAI

CVE-2019-25443 is an SQL injection vulnerability in the Inventory Webapp, specifically affecting the add-item.php endpoint. The flaw allows attackers to inject malicious SQL code through GET parameters such as name, description, quantity, or cat_id, enabling manipulation of database queries and execution of arbitrary database commands. It is classified under CWE-89 with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility, low complexity, and no required privileges or user interaction.

Unauthenticated attackers can exploit this vulnerability remotely by supplying crafted SQL payloads in the specified GET parameters to the add-item.php script. Successful exploitation grants high confidentiality impact, such as extracting sensitive data from the database, with low integrity impact like limited data modification, and no availability disruption.

Advisories and related resources, including an exploit proof-of-concept on Exploit-DB (https://www.exploit-db.com/exploits/47356) and a detailed advisory from VulnCheck (https://www.vulncheck.com/advisories/inventory-webapp-sql-injection-via-add-itemphp), document the issue but do not specify patches or mitigations in the provided details. Security practitioners should review these references for remediation guidance, such as input sanitization or parameterized queries.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection vulnerability in unauthenticated public-facing webapp directly enables T1190 (Exploit Public-Facing Application) for initial access and facilitates T1213.006 (Databases) for arbitrary data extraction via crafted SQL queries.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References