CVE-2019-25501
Published: 04 March 2026
Description
Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the app_id parameter. Attackers can send POST requests to delete_application_ajax.php with crafted payloads to extract sensitive data, bypass authentication,…
more
or modify database contents.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the app_id parameter to block malicious SQL injection payloads in database queries.
Enforces restrictions on app_id input format, such as numeric-only, to mitigate injection attempts exploiting improper handling.
Provides for identification, reporting, and correction of the specific SQL injection flaw in delete_application_ajax.php.
Security SummaryAI
CVE-2019-25501 is an SQL injection vulnerability (CWE-89) in Simple Job Script, affecting the delete_application_ajax.php component. The flaw arises from improper handling of the app_id parameter, which allows attackers to inject malicious SQL code into database queries. Published on 2026-03-04, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility and no authentication requirements.
Unauthenticated remote attackers can exploit the vulnerability by sending crafted POST requests to delete_application_ajax.php with malicious payloads in the app_id parameter. Successful exploitation enables manipulation of database queries to extract sensitive data, bypass authentication mechanisms, or modify database contents, resulting in high confidentiality impact and low integrity impact.
Advisories and references, including an Exploit-DB entry at https://www.exploit-db.com/exploits/46612 and a VulnCheck advisory at https://www.vulncheck.com/advisories/simple-job-script-sql-injection-via-delete-application-ajaxphp, detail the vulnerability and proof-of-concept exploitation but do not specify mitigation or patch information in the provided details.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing web component (delete_application_ajax.php) enables T1190 (Exploit Public-Facing Application) and facilitates T1213.006 (Databases) for sensitive data extraction via crafted SQL payloads.