CVE-2019-25458: Web-ofisi Firma Rehberi SQLi Vulnerability

CVE-2019-25458 Overview

CVE-2019-25458 is an SQL injection vulnerability [CWE-89] affecting Web Ofisi Firma Rehberi v1, a Turkish company directory script. Unauthenticated attackers can manipulate database queries by injecting SQL code through the il, kat, or kelime GET parameters on the firmalar.html endpoint. Successful exploitation enables extraction of sensitive database contents and supports time-based blind SQL injection techniques. The vulnerability requires no authentication and can be triggered remotely over the network. The flaw stems from direct concatenation of user-supplied input into SQL statements without sanitization or parameterization.

Critical Impact
Unauthenticated remote attackers can read arbitrary database contents, including user records and credentials, through crafted GET parameters.

Affected Products

Web Ofisi Firma Rehberi version 1.0.0
Deployments using the vulnerable firmalar.html endpoint
Installations exposing the il, kat, or kelime GET parameters

Discovery Timeline

2026-02-22 - CVE-2019-25458 published to NVD
2026-03-02 - Last updated in NVD database

Technical Details for CVE-2019-25458

Vulnerability Analysis

The vulnerability resides in the firmalar.html request handler of Web Ofisi Firma Rehberi v1. The script accepts the il (province), kat (category), and kelime (keyword) parameters via HTTP GET and embeds them directly into backend SQL statements. Because the inputs are not validated, escaped, or bound through prepared statements, attackers can break out of the intended query context and append arbitrary SQL clauses.

An attacker can use UNION SELECT payloads to exfiltrate columns from arbitrary tables, including administrative credentials. Where output is suppressed, time-based blind techniques using functions such as SLEEP() or BENCHMARK() allow boolean inference of database contents. The product has no authentication requirement for the affected endpoint, so any internet-facing instance is reachable by anonymous attackers.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The application concatenates GET parameter values into SQL queries without parameterized statements or input validation, violating safe query construction practices.

Attack Vector

Exploitation occurs over the network through HTTP requests to the firmalar.html endpoint. An attacker supplies a malicious payload in the il, kat, or kelime parameter. The request requires no privileges and no user interaction. Public exploitation details are available through Exploit-DB #47143 and the VulnCheck SQL Injection Advisory.

Detection Methods for CVE-2019-25458

Indicators of Compromise

HTTP GET requests to firmalar.html containing SQL syntax such as UNION SELECT, ORDER BY, single quotes, or comment markers (--, #, /*) within the il, kat, or kelime parameters.
Requests containing time-delay functions like SLEEP(, BENCHMARK(, or WAITFOR DELAY in query strings.
Anomalous database error responses or unusually long response times originating from the company directory pages.
Spikes in unique GET requests to firmalar.html from a single source IP enumerating values in the affected parameters.

Detection Strategies

Deploy web application firewall rules that flag SQL metacharacters and known SQLi payload patterns targeting the firmalar.html endpoint.
Enable database query logging and alert on UNION-based or time-delay queries originating from the application service account.
Correlate web server access logs with database error logs to identify failed injection attempts that surface SQL syntax errors.

Monitoring Recommendations

Monitor outbound data volumes from the web server and database tier to detect bulk record exfiltration.
Track response time distributions for firmalar.html requests to surface time-based blind injection attempts.
Review authentication tables for unexpected reads or modifications following suspicious GET requests.

How to Mitigate CVE-2019-25458

Immediate Actions Required

Restrict public access to the firmalar.html endpoint until a remediated version is deployed, using IP allowlists or authentication proxies where feasible.
Deploy WAF signatures that block SQL injection payloads in the il, kat, and kelime parameters.
Audit the database for unauthorized reads, rotate stored credentials, and review administrative accounts for tampering.

Patch Information

No vendor patch is documented in the available references. Operators should consult the Web-Ofisi Script Details page for current vendor status and consider migrating away from the v1 release. Where the application source is accessible, rewrite the affected queries to use parameterized statements or prepared queries with bound parameters.

Workarounds

Implement server-side input validation that restricts the il, kat, and kelime parameters to expected character sets and lengths.
Apply least-privilege permissions to the database account used by the application so it cannot read sensitive tables outside its scope.
Place the application behind a reverse proxy with SQL injection filtering enabled until the underlying code is remediated.

bash

# Example ModSecurity rule to block SQLi payloads on the affected endpoint
SecRule REQUEST_URI "@contains /firmalar.html" \
  "phase:2,chain,deny,status:403,id:1925458,msg:'CVE-2019-25458 SQLi attempt'"
  SecRule ARGS:il|ARGS:kat|ARGS:kelime \
    "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|#|';)"