CVE-2019-25526
Published: 12 March 2026
Description
Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the location parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads in…
more
the location field to extract sensitive data or modify database contents.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the location parameter before database query processing.
Ensures timely identification, reporting, and correction of the specific SQL injection flaw in the searchdetailed endpoint.
Boundary protection mechanisms such as web application firewalls monitor and filter incoming POST requests to block SQL injection payloads targeting the location parameter.
Security SummaryAI
CVE-2019-25526 is an SQL injection vulnerability (CWE-89) in Inout EasyRooms Ultimate Edition v1.0. The flaw resides in the search/searchdetailed endpoint, where the location parameter in POST requests fails to properly sanitize input, enabling attackers to inject arbitrary SQL code and manipulate database queries.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges, user interaction, or special setup. By sending crafted POST requests with malicious SQL payloads in the location field, they can extract sensitive data from the database (high confidentiality impact) or modify database contents (low integrity impact), though availability remains unaffected, as reflected in the CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Advisories detailing the vulnerability and proof-of-concept exploits are available at https://www.exploit-db.com/exploits/46630 and https://www.vulncheck.com/advisories/inout-easyrooms-ultimate-edition-sql-injection-via-search. No specific patches or mitigation steps are described in the provided information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application endpoint directly enables T1190 (Exploit Public-Facing Application) for unauthenticated remote access and facilitates T1213.006 (Data from Databases) for extracting sensitive data via arbitrary SQL queries.