CVE-2019-25699

OVERVIEW CVE-2019-25699 is a SQL injection vulnerability affecting Newsbull Haber Script version 1.0.0. The flaw exists in the search parameter across multiple administrative endpoints including /admin/comment/records, /admin/category/records, /admin/news/records, and /admin/menu/childs. Authenticated attackers can inject malicious SQL code to manipulate database queries and extract sensitive information using time-based, blind, and boolean-based injection techniques. SEVERITY The vulnerability carries a CVSS score of 7.1 (HIGH) with a network-based attack vector requiring low complexity and authenticated user privileges. While the confidentiality impact is rated high due to potential database information disclosure, the integrity impact is limited and availability is not affected. The attack requires valid credentials and no user interaction, making it a moderate risk within authenticated environments. EXPLOITATION STATUS This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.0001 indicates extremely low probability of exploitation relative to other CVEs. Community attention appears minimal, and the vulnerability remains inactive on industry hot lists. However, organizations running Newsbull Haber Script 1.0.0 should still prioritize patching due to the straightforward nature of SQL injection attacks.