Which versions of Bootstrapy CMS are affected by EUVD-2019-20024?

Bootstrapy CMS contains an unauthenticated SQL injection vulnerability (CVSS 8.8) affecting forum and contact modules that allows remote attackers to extract sensitive database information without…

Is there a public PoC exploit available for EUVD-2019-20024?

Yes, a public proof-of-concept exploit is available for EUVD-2019-20024. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2019-20024?

Within 24 hours: Identify all systems running Bootstrapy CMS and verify current version; disable or restrict network access to forum-thread.php, contact-submit.php, and post-new-submit.php endpoints if possible. Within 7 days: Contact Bootstrapy CMS vendor for patch availability and timeline; implement Web Application Firewall (WAF) rules to block malicious SQL injection payloads targeting the identified POST parameters (thread_id, subject, post-id). Within 30 days: Migrate to a patched Bootstrapy CMS version once available, or migrate to an alternative CMS platform if vendor patch is not released; conduct database audit for signs of unauthorized access or data exfiltration.

Bootstrapy CMS EUVD-2019-20024

Q: What is the CVSS score of EUVD-2019-20024?

EUVD-2019-20024 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2019-25642 HIGH

SQL Injection (CWE-89)

2026-03-24 VulnCheck

GHSA-v4f2-83rf-qgg3

PHP SQLi Denial Of Service Bootstrap

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 01, 2026 - 15:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 01, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

May 01, 2026 - 15:22 NVD

8.2 (HIGH) 8.8 (HIGH)

PoC Detected

Mar 24, 2026 - 15:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 24, 2026 - 11:45 euvd

EUVD-2019-20024

Analysis Generated

Mar 24, 2026 - 11:45 vuln.today

CVE Published

Mar 24, 2026 - 11:27 nvd

HIGH 8.2

DescriptionCVE.org

Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can inject SQL payloads into the thread_id parameter of forum-thread.php, the subject parameter of contact-submit.php, the post-id parameter of post-new-submit.php, and the thread-id parameter to extract sensitive database information or cause denial of service.

AnalysisAI

Unauthenticated SQL injection in Bootstrapy CMS allows remote attackers to extract sensitive database information or cause denial of service through multiple POST parameters in forum and contact modules. The vulnerability affects forum-thread.php (thread_id), contact-submit.php (subject), and post-new-submit.php (post-id) endpoints. Public exploit code exists via Exploit-DB #46590, though EPSS probability remains low at 0.06% (19th percentile), suggesting limited real-world exploitation despite ease of attack (AV:N/AC:L/PR:N). SSVC framework confirms proof-of-concept availability and automated exploitation potential with partial technical impact.

Technical ContextAI

SQL injection (CWE-89) occurs when user-controlled data from POST parameters is concatenated directly into SQL queries without parameterization or proper escaping. Bootstrapy CMS, a PHP-based content management system per CPE identifier cpe:2.3:a:bootstrapy:bootstrapy_cms, fails to sanitize multiple inputs in its forum and contact modules. When attacker-supplied SQL metacharacters in parameters like thread_id, subject, or post-id are passed to the database layer, they break out of the intended query context and execute arbitrary SQL commands. The CVSS vector CVSS:4.0 indicates network-based attack with low complexity and no authentication required, enabling trivial remote exploitation. The vulnerability permits high confidentiality impact (VC:H) and low integrity impact (VI:L) to the vulnerable system, typical of SQL injection where attackers primarily exfiltrate data but can also modify limited records or trigger application errors causing denial of service.

RemediationAI

No vendor-released patch identified at time of analysis. The official Bootstrapy CMS website at bootstrapy.com provides no security advisories or updated versions addressing CVE-2019-25642. Organizations must implement compensating controls: deploy web application firewall rules blocking SQL metacharacters (single quotes, semicolons, UNION keywords, comment markers) in POST parameters to forum-thread.php, contact-submit.php, and post-new-submit.php endpoints, though this may break legitimate user input containing apostrophes or technical content. Alternatively, restrict network access to these vulnerable endpoints using IP allowlisting if forum/contact functionality is only needed internally, trading public accessibility for security. Most effective mitigation is migrating to maintained CMS platforms with active security support, as Bootstrapy CMS shows no evidence of ongoing maintenance. If migration is infeasible short-term, disable affected forum and contact modules entirely at application or web server level, eliminating attack surface at cost of those features.