How to fix CVE-2019-25488?

Within 24 hours: Identify all systems running Jettweb Hazir Rent A Car Script V4 and assess whether they are internet-exposed or contain sensitive data. Within 7 days: Implement WAF rules to block SQL injection patterns in GET parameters, restrict admin panel access to specific IP ranges, and enable database activity monitoring. Within 30 days: Evaluate migration to alternative, actively maintained rental management software or request custom patches from the vendor; if continuing use is necessary, implement database-level access controls and consider moving the application behind a VPN/bastion host.

Is PHP affected by CVE-2019-25488?

CVE-2019-25488 is a critical SQL injection vulnerability affecting Jettweb Hazir Rent A Car Script V4 that allows unauthenticated attackers to directly access and manipulate your database through the admin panel.

CVE-2019-25488

HIGH

2026-03-12 [email protected]

8.2

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Mar 17, 2026 - 20:09 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 16:16 nvd

HIGH 8.2

Description

Jettweb Hazir Rent A Car Scripti V4 contains multiple SQL injection vulnerabilities in the admin panel that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into the 'tur', 'id', and 'ozellikdil' parameters of the admin/index.php endpoint to extract sensitive database information or cause denial of service.

Analysis

Technical Context

Classified as CWE-89 (SQL Injection). Jettweb Hazir Rent A Car Scripti V4 contains multiple SQL injection vulnerabilities in the admin panel that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into the 'tur', 'id', and 'ozellikdil' parameters of the admin/index.php endpoint to extract sensitive database information or cause denial of service.

Affected Products

Component: GET.

Remediation

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +41

POC: +20

CVE-2019-25488 vulnerability details – vuln.today

Back

CVE-2019-25488

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2019-25488

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code