CVE-2019-25443
Published: 22 February 2026
Description
Inventory Webapp contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can supply malicious SQL payloads in the name, description, quantity, or cat_id parameters to add-item.php to execute…
more
arbitrary database commands.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by validating and sanitizing untrusted GET parameters (name, description, quantity, cat_id) before use in database queries.
Ensures timely identification, reporting, and correction of the SQL injection flaw in add-item.php to eliminate the vulnerability.
Detects the SQL injection vulnerability through regular vulnerability scanning of the web application, enabling remediation.
Security SummaryAI
CVE-2019-25443 is an SQL injection vulnerability in the Inventory Webapp, specifically affecting the add-item.php endpoint. The flaw allows attackers to inject malicious SQL code through GET parameters such as name, description, quantity, or cat_id, enabling manipulation of database queries and execution of arbitrary database commands. It is classified under CWE-89 with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility, low complexity, and no required privileges or user interaction.
Unauthenticated attackers can exploit this vulnerability remotely by supplying crafted SQL payloads in the specified GET parameters to the add-item.php script. Successful exploitation grants high confidentiality impact, such as extracting sensitive data from the database, with low integrity impact like limited data modification, and no availability disruption.
Advisories and related resources, including an exploit proof-of-concept on Exploit-DB (https://www.exploit-db.com/exploits/47356) and a detailed advisory from VulnCheck (https://www.vulncheck.com/advisories/inventory-webapp-sql-injection-via-add-itemphp), document the issue but do not specify patches or mitigations in the provided details. Security practitioners should review these references for remediation guidance, such as input sanitization or parameterized queries.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in unauthenticated public-facing webapp directly enables T1190 (Exploit Public-Facing Application) for initial access and facilitates T1213.006 (Databases) for arbitrary data extraction via crafted SQL queries.