CVE-2019-25531
Published: 12 March 2026
Description
Netartmedia Deals Portal contains an SQL injection vulnerability in the Email parameter of loginaction.php that allows unauthenticated attackers to manipulate database queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive information or bypass authentication mechanisms.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the Email parameter input in loginaction.php to block SQL injection payloads and prevent database query manipulation.
Ensures identification, reporting, and correction of the specific SQL injection flaw in loginaction.php through systematic flaw remediation.
Provides vulnerability scanning to detect the SQL injection vulnerability (CVE-2019-25531) in the Netartmedia Deals Portal for timely remediation.
Security SummaryAI
CVE-2019-25531 is an SQL injection vulnerability (CWE-89) affecting the Netartmedia Deals Portal, specifically in the Email parameter of the loginaction.php component. Published on 2026-03-12, it enables attackers to manipulate database queries through crafted inputs. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact.
Unauthenticated attackers can exploit this over the network with low attack complexity and no privileges or user interaction required. By submitting SQL payloads via POST requests to the Email parameter during login actions, they can extract sensitive information from the database or bypass authentication mechanisms.
Advisories and related resources, including a proof-of-concept on Exploit-DB and a Vulncheck advisory, provide details on the issue. Security practitioners should consult https://www.exploit-db.com/exploits/46582 and https://www.vulncheck.com/advisories/netartmedia-deals-portal-lastest-sql-injection-via-loginaction-php for exploitation demonstrations and potential mitigation guidance.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in a public-facing web application directly enables exploitation of public-facing applications (T1190) and data extraction from databases (T1213.006) via crafted queries.