CVE-2019-25543
Published: 12 March 2026
Description
Netartmedia Real Estate Portal 5.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the page parameter. Attackers can submit POST requests to index.php with malicious SQL payloads in the page…
more
field to bypass authentication, extract sensitive data, or modify database contents.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and sanitization of the 'page' parameter in POST requests to neutralize SQL injection payloads.
Mandates identification, reporting, and correction of the SQL injection flaw in the index.php component.
Enforces restrictions on the 'page' parameter to limit inputs to valid values, blocking malicious SQL code.
Security SummaryAI
CVE-2019-25543 is an SQL injection vulnerability in Netartmedia Real Estate Portal 5.0, specifically affecting the index.php component. The flaw arises from improper handling of the "page" parameter in POST requests, allowing attackers to inject malicious SQL code into database queries. It is rated with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) and maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no privileges required. By submitting crafted POST requests to index.php with SQL payloads in the page field, attackers can bypass authentication mechanisms, extract sensitive data from the database, or modify database contents, potentially leading to unauthorized access or data tampering.
Advisories from Vulncheck and an Exploit-DB entry (exploit 46563) document the issue, including a public proof-of-concept exploit demonstrating the SQL injection via the page parameter. No specific patches or mitigation steps are detailed in the provided references.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (index.php) enables exploitation of public-facing app (T1190) and data collection from databases (T1213.006).