Cyber Posture

CVE-2019-25525

HighPublic PoC

Published: 12 March 2026

Published
12 March 2026
Modified
19 March 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0025 48.1th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the guests parameter. Attackers can send POST requests to the search/rentals endpoint with malicious SQL payloads to…

more

bypass authentication, extract sensitive data, or modify database contents.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection in the 'guests' parameter by requiring validation of all user inputs before incorporation into database queries.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of known flaws like CVE-2019-25525 through identification, reporting, patching, and testing to eliminate the SQL injection vulnerability.

SI-9 Information Input Restrictions partial match
prevent

Restricts harmful inputs to the /search/rentals endpoint, such as limiting special characters in the 'guests' parameter to block SQL injection payloads.

Security SummaryAI

CVE-2019-25525 is an SQL injection vulnerability (CWE-89) in Inout EasyRooms Ultimate Edition v1.0. The flaw resides in the handling of the "guests" parameter within POST requests to the /search/rentals endpoint, enabling attackers to inject arbitrary SQL code into database queries. Published on 2026-03-12, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with moderate overall severity.

Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction by sending crafted POST requests containing malicious SQL payloads. Exploitation allows bypassing authentication mechanisms, extracting sensitive data from the database, or modifying database contents, potentially leading to unauthorized access and data compromise.

Advisories referenced in Exploit-DB (https://www.exploit-db.com/exploits/46630) and Vulncheck (https://www.vulncheck.com/advisories/inout-easyrooms-ultimate-edition-sql-injection-via-search-2) provide further details on the issue, including proof-of-concept exploits that security practitioners should review for mitigation guidance such as input sanitization or upgrading the software.

Details

CWE(s)
CWE-89

Affected Products

inoutscripts
inout homestay
1.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web application (T1190) enables unauthorized database access and data extraction (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References