Cyber Posture

CVE-2019-25527

HighPublic PoC

Published: 12 March 2026

Published
12 March 2026
Modified
19 March 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0025 48.1th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the numguest parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads to…

more

bypass authentication, extract sensitive data, or modify database contents.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of user inputs like the numguest parameter to prevent SQL injection attacks from manipulating database queries.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and correction of flaws such as the unsanitized numguest parameter enabling SQL injection.

RA-5 Vulnerability Monitoring and Scanning good match
preventdetect

Requires vulnerability scanning that would identify the SQL injection vulnerability in the search/searchdetailed endpoint for remediation.

Security SummaryAI

CVE-2019-25527 is an SQL injection vulnerability (CWE-89) in Inout EasyRooms Ultimate Edition v1.0. The flaw resides in the search/searchdetailed endpoint, where the numguest parameter fails to properly sanitize user input, allowing attackers to inject arbitrary SQL code and manipulate database queries.

Unauthenticated remote attackers can exploit this vulnerability with low complexity by sending crafted POST requests containing malicious SQL payloads to the affected endpoint. Successful exploitation enables bypassing authentication, extracting sensitive data from the database, or modifying database contents, as indicated by the CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), which reflects high confidentiality impact and low integrity impact.

Advisories from VulnCheck and an Exploit-DB entry (exploit 46630) document the vulnerability, including proof-of-concept details for the SQL injection via the numguest parameter. No specific patches or mitigation steps are detailed in the CVE information provided.

Details

CWE(s)
CWE-89

Affected Products

inoutscripts
inout homestay
1.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web application endpoint directly enables exploitation of public-facing apps (T1190) and data extraction/modification from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References