CVE-2019-25458
Published: 22 February 2026
Description
Web Ofisi Firma Rehberi v1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can send requests to with malicious payloads in the 'il', 'kat', or 'kelime' parameters…
more
to extract sensitive database information or perform time-based blind SQL injection attacks.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of untrusted GET parameters like 'il', 'kat', and 'kelime' to prevent SQL injection from manipulating database queries.
Directly addresses remediation of the specific SQL injection flaw in Web Ofisi Firma Rehberi v1 to eliminate the vulnerability.
Provides protections for publicly accessible web endpoints against unauthorized disclosure, modification, and insertion of malicious SQL payloads.
Security SummaryAI
CVE-2019-25458 is an SQL injection vulnerability (CWE-89) in Web Ofisi Firma Rehberi v1, published on 2026-02-22. The flaw allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters such as 'il', 'kat', or 'kelime' in requests to affected endpoints. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its potential for high impacts on confidentiality, integrity, and availability.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending requests with malicious payloads in the specified parameters, they can extract sensitive database information or conduct time-based blind SQL injection attacks, enabling data exfiltration, modification, or denial of service.
Advisories and related resources include an exploit proof-of-concept at https://www.exploit-db.com/exploits/47143, a vulnerability advisory at https://www.vulncheck.com/advisories/web-ofisi-firma-rehberi-sql-injection-via-firmalarhtml, and the product page at https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html. These references provide details on the issue but do not specify patches or mitigations in the available information.
A public exploit on Exploit-DB indicates potential for real-world exploitation against unpatched instances of this directory script.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a public-facing web application directly enables exploitation of public-facing applications (T1190) for unauthenticated remote access, data exfiltration, modification, and denial of service.