CVE-2019-25642
Published: 24 March 2026
Description
Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can inject SQL payloads into the thread_id parameter of forum-thread.php, the subject parameter of contact-submit.php, the…
more
post-id parameter of post-new-submit.php, and the thread-id parameter to extract sensitive database information or cause denial of service.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by validating and sanitizing vulnerable POST parameters like thread_id and subject before processing database queries.
Requires timely identification, reporting, and patching of the SQL injection flaws in Bootstrapy CMS PHP endpoints such as forum-thread.php.
Boundary protection mechanisms like web application firewalls can inspect and block malicious SQL payloads in unauthenticated POST requests.
Security SummaryAI
CVE-2019-25642 describes multiple SQL injection vulnerabilities (CWE-89) in Bootstrapy CMS, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). These flaws affect specific PHP endpoints where POST parameters are not properly sanitized: the thread_id parameter in forum-thread.php, the subject parameter in contact-submit.php, the post-id parameter in post-new-submit.php, and the thread-id parameter in an additional context.
Unauthenticated remote attackers can exploit these vulnerabilities by injecting arbitrary SQL payloads through the vulnerable POST parameters, enabling execution of malicious queries. Successful exploitation allows extraction of sensitive database information or denial of service, with high confidentiality impact, low integrity impact, and no availability impact per the CVSS vector.
Advisories, including those from Vulncheck detailing SQL injection via forum and contact modules, and an Exploit-DB entry (46590) providing proof-of-concept code, highlight the issues but do not specify patches or vendor-provided mitigations in the available references. The Bootstrapy CMS site (bootstrapy.com) is referenced as the primary source.
A public exploit on Exploit-DB indicates potential for real-world abuse against unpatched Bootstrapy CMS instances.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes unauthenticated SQL injection in public-facing Bootstrapy CMS endpoints, directly enabling T1190 (Exploit Public-Facing Application) for initial access and T1213.006 (Databases) for extracting sensitive database information via malicious SQL queries.