CVE-2019-25515
Published: 12 March 2026
Description
Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an authentication bypass vulnerability in the login.php administration panel that allows unauthenticated attackers to gain administrative access by submitting crafted SQL syntax. Attackers can bypass authentication by submitting equals signs and 'or'…
more
operators as username and password parameters to access the administration panel without valid credentials.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly and comprehensively prevents SQL injection in login.php by validating username and password inputs against crafted SQL syntax like equals signs and 'or' operators.
SI-2 requires identification, reporting, and correction of the specific SQL injection flaw enabling authentication bypass to administrative access.
RA-5 mandates scanning for vulnerabilities like the SQL injection in CVE-2019-25515 to identify it prior to exploitation.
Security SummaryAI
CVE-2019-25515 is an authentication bypass vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V3, specifically within the login.php administration panel. The flaw allows unauthenticated attackers to gain administrative access by submitting crafted SQL syntax, such as equals signs and 'or' operators, as username and password parameters. This issue is classified under CWE-89 (SQL Injection) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Unauthenticated attackers with network access can exploit the vulnerability remotely with low attack complexity and no user interaction. Exploitation bypasses login credentials entirely, granting full administrative access to the panel and enabling high confidentiality impacts, such as unauthorized access to sensitive administrative data.
Advisories and exploit details are available from Vulncheck at https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-authentication-bypass and Exploit-DB at https://www.exploit-db.com/exploits/46599, which include proof-of-concept information. The CVE description does not specify patches or mitigations.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a SQL injection in a public-facing web application's login.php admin panel, enabling unauthenticated remote exploitation for administrative access, directly mapping to Exploit Public-Facing Application.