CVE-2019-25515 is a critical authentication bypass vulnerability (CVSS 9.8) affecting Jettweb PHP Hazir Haber Sitesi Scripti V3 (php_stock_news_site_script). This flaw allows unauthenticated attackers to gain full administrative access to the login.php panel by submitting crafted SQL syntax, specifically using equals signs and 'or' operators in the username and password fields. The vulnerability has a network-based attack vector with low complexity, requiring no user interaction, and leads to complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation (KEV: No), nor are public exploit modules available in Metasploit, Nuclei, or ExploitDB, and it has received no community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3CPE matchmatch criteria | cpe:2.3:a:jettweb:php_stock_news_site_script:3:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.