CVE-2019-25534
SQL Injection in Netartmedia PHP Car Dealer Allows Data Theft
Publication date: 2026-03-12
Last updated on: 2026-03-12
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netartmedia | php_car_dealer | * |
| netartmedia | php_car_dealer | to 3.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2019-25534 is a high-severity SQL injection vulnerability in the Netartmedia PHP Car Dealer application. It allows unauthenticated attackers to inject malicious SQL code through the features[] parameter in POST requests to the index.php script.
By exploiting this vulnerability, attackers can execute arbitrary SQL queries, which may enable them to extract sensitive information from the database or manipulate database queries.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized access to sensitive database information and potential manipulation of database queries.
- Attackers can extract confidential data stored in the database.
- Attackers can alter database queries, potentially affecting the integrity of the data.
- Since the vulnerability requires no authentication or user interaction, it can be exploited remotely over the network with low complexity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending crafted POST requests to the index.php script with malicious SQL payloads injected into the features[] parameter and observing the response or behavior of the application.'}, {'type': 'paragraph', 'content': 'A common detection method is to use time-based blind SQL injection payloads that cause a delay in the server response if the vulnerability exists.'}, {'type': 'paragraph', 'content': 'For example, you can use the following payload in a POST request to test the vulnerability:'}, {'type': 'list_item', 'content': 'features[]=(select(0)from(select(sleep(5)))v)/*\'+(select(0)from(select(sleep(5)))v)+\'"+(select(0)from(select(sleep(5)))v)+\'*/'}, {'type': 'paragraph', 'content': 'This payload uses the MySQL sleep() function to delay the response by 5 seconds if the injection is successful.'}, {'type': 'paragraph', 'content': 'You can use tools like curl or Burp Suite to send such POST requests. For example, using curl:'}, {'type': 'list_item', 'content': 'curl -X POST -d "features[]=(select(0)from(select(sleep(5)))v)" https://targetsite.com/index.php?mod=search'}, {'type': 'paragraph', 'content': 'If the response time is significantly delayed, it indicates the presence of the SQL injection vulnerability.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Apply input validation and sanitization on the features[] parameter to prevent malicious SQL code injection.
- Use prepared statements or parameterized queries in the PHP code to safely handle user inputs.
- Restrict direct access to the vulnerable index.php script or disable the affected search functionality until a patch is applied.
- Monitor and block suspicious POST requests targeting the features[] parameter at the web application firewall (WAF) or network perimeter.
- Check for and apply any available updates or patches from the vendor or community addressing this vulnerability.