CVE-2019-25503

7.1 highEPSS 0.4%

High (7.1) in blondish phpads. EPSS 0.4% chance of exploitation in the next 30 days.

PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue to extract sensitive database information such as the current database name.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-03-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

blondish:phpads

References

https://www.exploit-db.com/exploits/46798
https://www.vulncheck.com/advisories/phpads-sql-injection-via-clickphp-bannerid

Check your stack JSON