CVE-2019-25458: Web Ofisi Firma Rehberi v1 SQL Injection via firmalar.html

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-22 · updated 2026-06-17
Weakness: CWE-89

Description

Web Ofisi Firma Rehberi v1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can send requests to with malicious payloads in the 'il', 'kat', or 'kelime' parameters to extract sensitive database information or perform time-based blind SQL injection attacks.

Affected products

Web-ofisi Firma Rehberi: 1.0.0

References

https://www.exploit-db.com/exploits/47143
https://www.vulncheck.com/advisories/web-ofisi-firma-rehberi-sql-injection-via-firmalarhtml
https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html

Get alerted when CVE-2019-25458 or the next vulnerability affects your stack