Cyber Posture

CVE-2019-25481

HighPublic PoC

Published: 12 March 2026

Published
12 March 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0012 30.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

iScripts ReserveLogic contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the jqSearchDestination parameter. Attackers can send POST requests to the search endpoint with crafted SQL payloads to extract sensitive database…

more

information.

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 directly and comprehensively prevents SQL injection by validating and sanitizing untrusted inputs like the jqSearchDestination parameter in POST requests to block malicious SQL code.

prevent

SI-9 mitigates SQL injection by restricting the types, lengths, and characteristics of inputs to the search endpoint, preventing oversized or malformed SQL payloads.

prevent

SI-2 addresses this specific CVE by requiring timely identification, reporting, and remediation of the SQL injection flaw in iScripts ReserveLogic.

Security SummaryAI

CVE-2019-25481 is an SQL injection vulnerability in iScripts ReserveLogic, affecting the search endpoint through the jqSearchDestination parameter. This flaw allows attackers to inject malicious SQL code into database queries via specially crafted POST requests. The vulnerability is classified under CWE-89 and carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability disruption.

Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction. By sending POST requests to the search endpoint with SQL payloads in the jqSearchDestination parameter, attackers can manipulate queries to extract sensitive database information, such as user credentials or other confidential data hosted by the application.

Advisories from Vulncheck document the SQL injection via the search endpoint in iScripts ReserveLogic, while a proof-of-concept exploit is publicly available on Exploit-DB (exploit ID 46640). No specific patches or mitigation steps are detailed in the provided references.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection vulnerability in public-facing web application search endpoint enables T1190 (Exploit Public-Facing Application) for unauthenticated remote exploitation and facilitates T1213.006 (Data from Information Repositories: Databases) by allowing arbitrary extraction of sensitive database information like user credentials.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References