Cyber Posture

CVE-2019-25642

HighPublic PoC

Published: 24 March 2026

Published
24 March 2026
Modified
01 May 2026
KEV Added
Patch
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0012 29.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can inject SQL payloads into the thread_id parameter of forum-thread.php, the subject parameter of contact-submit.php, the…

more

post-id parameter of post-new-submit.php, and the thread-id parameter to extract sensitive database information or cause denial of service.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents SQL injection by validating and sanitizing vulnerable POST parameters like thread_id and subject before processing database queries.

prevent

Requires timely identification, reporting, and patching of the SQL injection flaws in Bootstrapy CMS PHP endpoints such as forum-thread.php.

prevent

Boundary protection mechanisms like web application firewalls can inspect and block malicious SQL payloads in unauthenticated POST requests.

Security SummaryAI

CVE-2019-25642 describes multiple SQL injection vulnerabilities (CWE-89) in Bootstrapy CMS, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). These flaws affect specific PHP endpoints where POST parameters are not properly sanitized: the thread_id parameter in forum-thread.php, the subject parameter in contact-submit.php, the post-id parameter in post-new-submit.php, and the thread-id parameter in an additional context.

Unauthenticated remote attackers can exploit these vulnerabilities by injecting arbitrary SQL payloads through the vulnerable POST parameters, enabling execution of malicious queries. Successful exploitation allows extraction of sensitive database information or denial of service, with high confidentiality impact, low integrity impact, and no availability impact per the CVSS vector.

Advisories, including those from Vulncheck detailing SQL injection via forum and contact modules, and an Exploit-DB entry (46590) providing proof-of-concept code, highlight the issues but do not specify patches or vendor-provided mitigations in the available references. The Bootstrapy CMS site (bootstrapy.com) is referenced as the primary source.

A public exploit on Exploit-DB indicates potential for real-world abuse against unpatched Bootstrapy CMS instances.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

CVE describes unauthenticated SQL injection in public-facing Bootstrapy CMS endpoints, directly enabling T1190 (Exploit Public-Facing Application) for initial access and T1213.006 (Databases) for extracting sensitive database information via malicious SQL queries.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References