Cyber Posture

CVE-2019-25674

HighPublic PoC

Published: 05 April 2026

Published
05 April 2026
Modified
09 April 2026
KEV Added
Patch
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0027 50.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or…

more

perform time-based blind SQL injection attacks.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the SQL injection vulnerability by requiring validation and sanitization of the untrusted 'post' parameter in post.php to block malicious SQL code injection.

prevent

Requires timely identification, reporting, and remediation of the specific SQL injection flaw in post.php, preventing attacker exploitation of database queries.

prevent

Enforces boundary protection via web application firewalls or proxies to inspect and block SQL injection payloads in unauthenticated GET requests to post.php.

Security SummaryAI

CVE-2019-25674 is an SQL injection vulnerability (CWE-89) affecting CMSsite version 1.0. The issue occurs in the post.php component, where the 'post' parameter in GET requests fails to properly sanitize input, enabling attackers to inject arbitrary SQL code and manipulate database queries.

Unauthenticated remote attackers can exploit this vulnerability with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By crafting malicious 'post' parameter values in GET requests to post.php, attackers can extract sensitive database information or perform time-based blind SQL injection attacks, resulting in high confidentiality impact and low integrity impact.

Advisories from Vulncheck and an Exploit-DB entry (exploit 46402) describe the vulnerability and include proof-of-concept exploits demonstrating the SQL injection via the 'post' parameter. The CMSsite GitHub repository serves as the source for the affected software, though no patches or specific mitigations are detailed in the referenced materials.

Details

CWE(s)

Affected Products

victoralagwu
cmssite
1.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing CMS web application (post.php) enables exploitation of public-facing application (T1190) and extraction of sensitive data from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References