Cyber Posture

CVE-2019-25456

CriticalPublic PoC

Published: 22 February 2026

Published
22 February 2026
Modified
02 March 2026
KEV Added
—
Patch
—
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS Score 0.0016 36.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Web Ofisi Emlak v2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'ara' GET parameter. Attackers can send requests to with time-based SQL injection payloads to extract sensitive database…

more

information or cause denial of service.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mandates validation and sanitization of user inputs like the 'ara' GET parameter to block SQL injection payloads.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of software flaws, such as the lack of input sanitization causing this SQL injection vulnerability.

SI-4 System Monitoring partial match
detect

Enables real-time monitoring to identify anomalous database queries or time-based SQL injection attempts.

Security SummaryAI

CVE-2019-25456 is an SQL injection vulnerability (CWE-89) in Web Ofisi Emlak v2, where the 'ara' GET parameter fails to properly sanitize user input, allowing attackers to inject and manipulate database queries. This flaw affects the real estate script software, enabling arbitrary SQL code execution. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) and was published on 2026-02-22T15:16:15.187.

Unauthenticated attackers with network access can exploit this vulnerability remotely and with low complexity, without requiring user interaction. By sending crafted requests with time-based SQL injection payloads through the 'ara' parameter, they can extract sensitive database information or trigger denial of service conditions.

References include a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/47141), a Vulncheck advisory detailing the SQL injection via the 'ara' parameter (https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-ara-parameter), and the vendor product page for Emlak Scripti v2 (https://www.web-ofisi.com/detay/emlak-scripti-v2.html).

Details

CWE(s)
CWE-89

Affected Products

web-ofisi
emlak
2.0.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web app directly enables exploitation (T1190), arbitrary database queries for data extraction (T1213.006), and DoS conditions (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References