CVE-2019-25446: DIGIT CENTRIS ERP SQLi Vulnerability

CVE-2019-25446 Overview

DIGIT CENTRIS ERP contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the datum1, datum2, KID, and PID parameters. Attackers can send POST requests to /korisnikinfo.php with malicious SQL syntax in these parameters to extract or modify sensitive database information.

Critical Impact

Unauthenticated attackers can exploit this SQL injection flaw to extract sensitive data, modify database contents, or potentially compromise the entire backend database system.

Affected Products

• DIGIT CENTRIS ERP (all versions)

Discovery Timeline

• 2026-02-22 - CVE CVE-2019-25446 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2019-25446

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) resides in the /korisnikinfo.php endpoint of DIGIT CENTRIS ERP. The application fails to properly sanitize user-supplied input in the datum1, datum2, KID, and PID POST parameters before incorporating them into SQL queries. This lack of input validation allows attackers to inject arbitrary SQL statements that are executed with the privileges of the database user configured for the application.

The vulnerability is particularly severe because it requires no authentication, meaning any network-accessible attacker can exploit it. Successful exploitation can lead to unauthorized access to sensitive business data, modification of critical records, and potential lateral movement within the organization's infrastructure if database credentials are shared or reused.

Root Cause

The root cause of this vulnerability is improper input validation and failure to use parameterized queries or prepared statements. The application directly concatenates user-controlled input into SQL query strings without adequate sanitization, escaping, or type validation. This is a fundamental secure coding violation that allows attackers to break out of the intended query structure and inject their own SQL commands.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP POST requests targeting the /korisnikinfo.php endpoint with SQL injection payloads in the vulnerable parameters (datum1, datum2, KID, PID). The injected SQL code is then executed against the backend database.

Common exploitation techniques include:

• Union-based injection - Appending UNION SELECT statements to extract data from other tables
• Error-based injection - Triggering database errors that reveal schema information
• Blind injection - Using boolean or time-based techniques to infer data character by character
• Stacked queries - Executing multiple SQL statements to modify data or database structure

Technical details and proof-of-concept examples can be found in the Exploit-DB #47401 entry and the VulnCheck Advisory.

Detection Methods for CVE-2019-25446

Indicators of Compromise

• Unusual POST requests to /korisnikinfo.php containing SQL syntax keywords such as UNION, SELECT, INSERT, UPDATE, DELETE, or comment sequences (--, /**/)
• Database logs showing malformed queries, syntax errors, or unexpected query patterns
• Anomalous data access patterns in database audit logs, particularly bulk data reads or schema enumeration
• Web application firewall alerts for SQL injection patterns targeting the identified parameters

Detection Strategies

• Deploy Web Application Firewall (WAF) rules specifically targeting SQL injection patterns in the datum1, datum2, KID, and PID parameters
• Implement database activity monitoring to detect anomalous query patterns, unauthorized data access, or schema enumeration attempts
• Configure intrusion detection systems (IDS) to alert on HTTP traffic containing SQL injection payloads targeting the vulnerable endpoint
• Enable verbose logging on the web server and database to capture and correlate suspicious request patterns

Monitoring Recommendations

• Monitor HTTP access logs for POST requests to /korisnikinfo.php with suspicious parameter values
• Set up alerts for database errors that may indicate attempted SQL injection, such as syntax errors or permission denials
• Track database query execution times to detect time-based blind SQL injection attempts
• Implement rate limiting on the vulnerable endpoint to slow down automated exploitation attempts

How to Mitigate CVE-2019-25446

Immediate Actions Required

• Restrict network access to the DIGIT CENTRIS ERP application, limiting exposure to trusted networks only
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules in front of the application
• Review database user privileges and implement principle of least privilege to limit potential damage from SQL injection
• Enable comprehensive logging on both the web server and database to capture exploitation attempts

Patch Information

No vendor patch information is currently available for this vulnerability. Organizations should contact DIGIT directly for remediation guidance or consider the workarounds listed below.

Workarounds

• Implement input validation at the application layer or through a reverse proxy to sanitize the datum1, datum2, KID, and PID parameters
• Deploy a WAF rule to block requests containing SQL injection patterns targeting /korisnikinfo.php
• Restrict database user permissions to read-only access where possible to limit the impact of successful exploitation
• Consider network segmentation to isolate the ERP system from untrusted network segments

# Example WAF rule concept for ModSecurity
# Block SQL injection attempts on vulnerable endpoint
SecRule REQUEST_URI "@contains /korisnikinfo.php" \
  "id:100001,phase:2,deny,status:403,msg:'SQL Injection Attempt',\
  chain"
SecRule ARGS "@rx (?i)(union|select|insert|update|delete|drop|--|\/\*)" \
  "t:none,t:urlDecodeUni,t:htmlEntityDecode"