CVE-2019-25519

Name of the Vulnerable Software and Affected Versions Jettweb PHP Hazir Haber Sitesi Scripti version 1

Description The software contains a SQL injection flaw that allows attackers to manipulate database queries. This is achieved by injecting malicious SQL code through the option parameter. Attackers can send POST requests to the ''uyelik.php'' endpoint with crafted payloads in the option parameter to execute time-based SQL injection attacks and extract sensitive database information.

Recommendations Apply input validation and sanitization to the option parameter in the ''uyelik.php'' endpoint to prevent the injection of malicious SQL code.