What is the CVSS score of CVE-2019-25540?

CVE-2019-25540 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2019-25540?

Netartmedia PHP Mall 4.1 contains critical SQL injection vulnerabilities that allow unauthenticated attackers to access, modify, or delete sensitive database information without valid credentials.

Is there a public PoC exploit available for CVE-2019-25540?

Yes, a public proof-of-concept exploit is available for CVE-2019-25540. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2019-25540?

Within 24 hours: Immediately audit all systems running Netartmedia PHP Mall 4.1 and isolate affected instances from production networks if possible. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns, implement input validation at the application layer, and restrict database user permissions to least-privilege access. Within 30 days: Evaluate alternative e-commerce solutions and develop migration timeline, as no vendor patch is available; conduct forensic analysis to determine if breach occurred.

PHP CVE-2019-25540

HIGH

SQL Injection (CWE-89)

2026-03-12 disclosure@vulncheck.com

PHP SQLi Netartmedia Php Mall

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Mar 23, 2026 - 13:32 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 16:16 nvd

HIGH 8.2

DescriptionCVE.org

Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various parameters. Attackers can craft malicious requests with SQL payloads to extract sensitive database information including user credentials and system data.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various parameters. Attackers can craft malicious requests with SQL payloads to extract sensitive database information including user credentials and system data.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.