CVE-2019-25578 | THREATINT

Description

phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to GeneratePDF.php with SQL payloads in the idnews parameter to extract sensitive database information or manipulate queries.

PUBLISHED Reserved 2026-03-21 | Published 2026-03-21 | Updated 2026-03-26 | Assigner VulnCheck

HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Problem types

CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')

Product status

Default status

unaffected

2016.9

affected

Credits

Ihsan Sencan finder

References

www.exploit-db.com/exploits/46191 (ExploitDB-46191) exploit

phptransformer.com/ (Official Product Homepage) product

netcologne.dl.sourceforge.net/...n 2016.9/release_2016.9.zip (Product Reference) product

www.vulncheck.com/...ormer-sql-injection-via-generatepdf-php (VulnCheck Advisory: phpTransformer 2016.9 SQL Injection via GeneratePDF.php) third-party-advisory

cve.org (CVE-2019-25578)

nvd.nist.gov (CVE-2019-25578)

Download JSON