CVE-2019-25578

CVE-2019-25578 identifies an SQL injection vulnerability within phpTransformer version 2016.9, allowing remote attackers to execute arbitrary SQL queries. This flaw specifically impacts the GeneratePDF.php component, where malicious payloads can be injected via the 'idnews' GET parameter. Rated with a CVSS score of 8.2 (High), it presents a low-complexity attack vector over the network, requiring no privileges or user interaction, and primarily poses a high risk to confidentiality by enabling sensitive database information extraction, with a low impact on integrity. Despite its severity, there is no evidence of active exploitation, nor are public exploits available in common databases like Metasploit or ExploitDB. Community discussion and media coverage are currently non-existent, indicating very low public attention and a low probability of exploitation.