CVE-2019-25514
Published: 12 March 2026
Description
Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows attackers to inject malicious SQL commands through the kelime parameter in POST requests. Attackers can manipulate the kelime parameter with UNION-based SQL injection payloads to extract…
more
sensitive data from the database or bypass authentication controls.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation of inputs like the 'kelime' parameter to block malicious SQL commands.
Mandates timely identification, reporting, and correction of flaws such as this SQL injection vulnerability through patching or code remediation.
Enforces restrictions on input parameters like 'kelime' to limit payload size, format, or type, reducing SQL injection attack surface.
Security SummaryAI
CVE-2019-25514 is an SQL injection vulnerability (CWE-89) in Jettweb PHP Hazir Haber Sitesi Scripti V3. The flaw resides in the kelime parameter processed via POST requests, where insufficient input sanitization allows attackers to inject malicious SQL commands. Specifically, UNION-based SQL injection payloads can be used to manipulate database queries.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required, as indicated by the CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Successful exploitation enables extraction of sensitive data from the database or bypassing authentication controls, resulting in high confidentiality impact and low integrity impact.
Advisories and proof-of-concept exploits are documented in public references, including Exploit-DB at https://www.exploit-db.com/exploits/46599 and VulnCheck at https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-sql-injection-3. These resources detail the vulnerability but do not specify patches or vendor-provided mitigations in the available information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing PHP web script enables exploitation of public-facing application (T1190) for initial access or auth bypass, and UNION-based payloads facilitate querying databases for sensitive data extraction (T1213.006).