CVE-2019-25498
Published: 04 March 2026
Description
Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the landing_location parameter. Attackers can send POST requests to the searched endpoint with malicious SQL payloads to bypass authentication…
more
and extract sensitive database information.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation and sanitization of the landing_location parameter at the searched endpoint before database query execution.
Mandates timely identification, reporting, and correction of the specific SQL injection flaw in the Simple Job Script application.
Enforces restrictions on input format and content for the landing_location parameter to block malicious SQL payloads at the critical entry point.
Security SummaryAI
CVE-2019-25498 is an SQL injection vulnerability (CWE-89) in Simple Job Script, affecting the searched endpoint. The flaw arises from improper handling of the landing_location parameter, which allows attackers to inject malicious SQL code into database queries. It carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low attack complexity and no privileges required.
Unauthenticated attackers can exploit this vulnerability remotely by sending POST requests to the searched endpoint with SQL payloads in the landing_location parameter. Successful exploitation enables manipulation of database queries to bypass authentication mechanisms and extract sensitive information from the database.
Advisories and proof-of-concept exploits are available at https://www.exploit-db.com/exploits/46612 and https://www.vulncheck.com/advisories/simple-job-script-sql-injection-via-searched-endpoint, which detail the vulnerability and potential exploitation paths.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2019-25498 is an unauthenticated SQL injection in a public-facing web application endpoint, directly enabling T1190 (Exploit Public-Facing Application). Exploitation facilitates arbitrary database queries for data extraction, mapping to T1213.006 (Data from Information Repositories: Databases).