How to fix CVE-2019-25524?

Within 24 hours: Inventory all XooGallery installations and assess internet accessibility; isolate critical instances from public networks if possible. Within 7 days: Deploy WAF rules to block SQL injection patterns in the 'p' parameter and monitor logs for exploitation attempts; contact XooGallery vendor for patch timeline. Within 30 days: Migrate to a patched version immediately upon release, or decommission XooGallery and replace with a supported gallery solution.

Is PHP affected by CVE-2019-25524?

XooGallery installations are vulnerable to unauthenticated SQL injection attacks that could allow attackers to extract, modify, or delete sensitive database contents without requiring valid credentials.

CVE-2019-25524

HIGH

2026-03-12 [email protected]

8.2

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Mar 23, 2026 - 13:39 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 16:16 nvd

HIGH 8.2

Description

XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'p' parameter. Attackers can send GET requests to results.php with malicious 'p' values to bypass authentication, extract sensitive data, or modify database contents.

Analysis

XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'p' parameter. [CVSS 8.2 HIGH]

Technical Context

Classified as CWE-89 (SQL Injection). XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'p' parameter. Attackers can send GET requests to results.php with malicious 'p' values to bypass authentication, extract sensitive data, or modify database contents.

Affected Products

XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code t

Remediation

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.2

CVSS: +41

POC: +20

CVE-2019-25524 vulnerability details – vuln.today

Back

CVE-2019-25524

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2019-25524

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code