CVE-2019-25459
Published: 22 February 2026
Description
Web Ofisi Emlak V2 contains multiple SQL injection vulnerabilities in the endpoint that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into parameters like emlak_durumu, emlak_tipi, il, ilce, kelime, and semt to extract…
more
sensitive database information or perform time-based blind SQL injection attacks.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation of untrusted GET parameters like emlak_durumu before processing database queries.
Restricts input length, format, and content of vulnerable parameters such as il and semt to block malicious SQL payloads.
Requires timely remediation of the identified SQL injection flaw to eliminate the vulnerability in the endpoint.
Security SummaryAI
CVE-2019-25459 involves multiple SQL injection vulnerabilities (CWE-89) in Web Ofisi Emlak V2. These flaws affect an endpoint that processes GET parameters including emlak_durumu, emlak_tipi, il, ilce, kelime, and semt, enabling attackers to inject malicious SQL code and manipulate database queries.
Unauthenticated attackers can exploit the vulnerability remotely over the network with low attack complexity and no user interaction or privileges required, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation allows extraction of sensitive database information or execution of time-based blind SQL injection attacks.
Advisories and proof-of-concept details are documented in references such as Exploit-DB (exploit 47142), VulnCheck advisory on the emlak-ara.html endpoint, and the vendor's page for Emlak Scripti V3. No specific patch or mitigation details are outlined in the provided information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application directly enables T1190 (Exploit Public-Facing Application). Allows arbitrary database query manipulation for sensitive data extraction, mapping to T1213.006 (Data from Information Repositories: Databases).