CVE-2019-25674
Published: 05 April 2026
Description
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or…
more
perform time-based blind SQL injection attacks.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the SQL injection vulnerability by requiring validation and sanitization of the untrusted 'post' parameter in post.php to block malicious SQL code injection.
Requires timely identification, reporting, and remediation of the specific SQL injection flaw in post.php, preventing attacker exploitation of database queries.
Enforces boundary protection via web application firewalls or proxies to inspect and block SQL injection payloads in unauthenticated GET requests to post.php.
Security SummaryAI
CVE-2019-25674 is an SQL injection vulnerability (CWE-89) affecting CMSsite version 1.0. The issue occurs in the post.php component, where the 'post' parameter in GET requests fails to properly sanitize input, enabling attackers to inject arbitrary SQL code and manipulate database queries.
Unauthenticated remote attackers can exploit this vulnerability with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By crafting malicious 'post' parameter values in GET requests to post.php, attackers can extract sensitive database information or perform time-based blind SQL injection attacks, resulting in high confidentiality impact and low integrity impact.
Advisories from Vulncheck and an Exploit-DB entry (exploit 46402) describe the vulnerability and include proof-of-concept exploits demonstrating the SQL injection via the 'post' parameter. The CMSsite GitHub repository serves as the source for the affected software, though no patches or specific mitigations are detailed in the referenced materials.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing CMS web application (post.php) enables exploitation of public-facing application (T1190) and extraction of sensitive data from databases (T1213.006).