What’s Vulnerable › Vulnerabilities

CVE-2019-25503: PHPads 2.0 SQL Injection via click.php3 bannerID

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-04 · updated 2026-06-17
• Weakness: CWE-89

Description

PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue to extract sensitive database information such as the current database name.

Affected products

• Blondish PHPads: 2.0

References

• https://www.exploit-db.com/exploits/46798
• https://www.vulncheck.com/advisories/phpads-sql-injection-via-clickphp-bannerid

Get alerted when CVE-2019-25503 or the next vulnerability affects your stack