CVE-2019-25481
Published: 12 March 2026
Description
iScripts ReserveLogic contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the jqSearchDestination parameter. Attackers can send POST requests to the search endpoint with crafted SQL payloads to extract sensitive database…
more
information.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly and comprehensively prevents SQL injection by validating and sanitizing untrusted inputs like the jqSearchDestination parameter in POST requests to block malicious SQL code.
SI-9 mitigates SQL injection by restricting the types, lengths, and characteristics of inputs to the search endpoint, preventing oversized or malformed SQL payloads.
SI-2 addresses this specific CVE by requiring timely identification, reporting, and remediation of the SQL injection flaw in iScripts ReserveLogic.
Security SummaryAI
CVE-2019-25481 is an SQL injection vulnerability in iScripts ReserveLogic, affecting the search endpoint through the jqSearchDestination parameter. This flaw allows attackers to inject malicious SQL code into database queries via specially crafted POST requests. The vulnerability is classified under CWE-89 and carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability disruption.
Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction. By sending POST requests to the search endpoint with SQL payloads in the jqSearchDestination parameter, attackers can manipulate queries to extract sensitive database information, such as user credentials or other confidential data hosted by the application.
Advisories from Vulncheck document the SQL injection via the search endpoint in iScripts ReserveLogic, while a proof-of-concept exploit is publicly available on Exploit-DB (exploit ID 46640). No specific patches or mitigation steps are detailed in the provided references.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in public-facing web application search endpoint enables T1190 (Exploit Public-Facing Application) for unauthenticated remote exploitation and facilitates T1213.006 (Data from Information Repositories: Databases) by allowing arbitrary extraction of sensitive database information like user credentials.