Cyber Posture

CVE-2019-25458

CriticalPublic PoC

Published: 22 February 2026

Published
22 February 2026
Modified
02 March 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Web Ofisi Firma Rehberi v1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can send requests to with malicious payloads in the 'il', 'kat', or 'kelime' parameters…

more

to extract sensitive database information or perform time-based blind SQL injection attacks.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires validation of untrusted GET parameters like 'il', 'kat', and 'kelime' to prevent SQL injection from manipulating database queries.

prevent

Directly addresses remediation of the specific SQL injection flaw in Web Ofisi Firma Rehberi v1 to eliminate the vulnerability.

prevent

Provides protections for publicly accessible web endpoints against unauthorized disclosure, modification, and insertion of malicious SQL payloads.

Security SummaryAI

CVE-2019-25458 is an SQL injection vulnerability (CWE-89) in Web Ofisi Firma Rehberi v1, published on 2026-02-22. The flaw allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters such as 'il', 'kat', or 'kelime' in requests to affected endpoints. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its potential for high impacts on confidentiality, integrity, and availability.

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending requests with malicious payloads in the specified parameters, they can extract sensitive database information or conduct time-based blind SQL injection attacks, enabling data exfiltration, modification, or denial of service.

Advisories and related resources include an exploit proof-of-concept at https://www.exploit-db.com/exploits/47143, a vulnerability advisory at https://www.vulncheck.com/advisories/web-ofisi-firma-rehberi-sql-injection-via-firmalarhtml, and the product page at https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html. These references provide details on the issue but do not specify patches or mitigations in the available information.

A public exploit on Exploit-DB indicates potential for real-world exploitation against unpatched instances of this directory script.

Details

CWE(s)

Affected Products

web-ofisi
firma rehberi
1.0.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection in a public-facing web application directly enables exploitation of public-facing applications (T1190) for unauthenticated remote access, data exfiltration, modification, and denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References