internet-facing-service-vulnerabilityproof-of-concept-releasemass-credential-exposure

Unauthenticated SQL Injection Flaws Expose Data in CMSsite and XATABoost CMS

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 12, 2026

Two content management systems were identified with unauthenticated SQL injection vulnerabilities that allow remote attackers to tamper with backend database queries and extract sensitive information. CVE-2019-25697 affects CMSsite 1.0, where the cat_id parameter in category.php can be abused through crafted GET requests, potentially exposing usernames, credentials, and other database contents.

A separate flaw, CVE-2018-25300, affects XATABoost CMS 1.0.0 through a union-based SQL injection in the id parameter of news.php, also reachable remotely without authentication via crafted GET requests. Both records were published with CWE-89 classification, CVSS v3.1 and v4.0 scoring data, and references to public advisories and exploit resources, underscoring the risk of database compromise in internet-exposed deployments.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Apr 12, 2026 – Apr 29, 2026

Apr 29, 20266mo ago
CVE-2018-25300 submitted for XATABoost CMS 1.0.0 SQL injection flaw
A new CVE entry for an unauthenticated union-based SQL injection in the id parameter of news.php in XATABoost CMS 1.0.0 was received by disclosure@vulncheck.com. The flaw can be exploited remotely via crafted GET requests to extract sensitive database information.
Apr 12, 20267mo ago
CMSsite 1.0 SQL injection vulnerability documented as CVE-2019-25697
A CVE record describes an unauthenticated SQL injection flaw in the cat_id parameter handled by category.php in CMSsite 1.0. The issue can be exploited with crafted GET requests to manipulate database queries and expose sensitive information such as usernames and credentials.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

2 linked

SQL Injection in CMSsite 1.0 category.php cat_id Parameter (CVE-2019-25697)SQL Injection in XATABoost CMS 1.0.0 news.php id Parameter (CVE-2018-25300)

Organizations

1 linked

XATABoost

Observables

2 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Apr 29, 2026

CVE-2018-25300 - XATABoost CMS 1.0.0 SQL Injection via news.phpOpen source ↗

Cvefeed High SeverityAdvisories · Apr 12, 2026

CVE-2019-25697 - CMSsite 1.0 SQL Injection via category.phpOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Unauthenticated SQL Injection Flaws Expose Data in CMSsite and XATABoost CMS

How this story unfolded

CVE-2018-25300 submitted for XATABoost CMS 1.0.0 SQL injection flaw

CMSsite 1.0 SQL injection vulnerability documented as CVE-2019-25697

Related entities

Vulnerabilities

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Payload CMS SQL Injection Flaw Allows Low-Privilege Authenticated Attacks

SQL Injection Flaws Expose SourceCodester and CodeAstro Management Apps

CI4MS Stored DOM XSS Flaws Enable Account Takeover and Privilege Escalation

Unauthenticated SQL Injection Flaws Expose Data in CMSsite and XATABoost CMS

How this story unfolded

CVE-2018-25300 submitted for XATABoost CMS 1.0.0 SQL injection flaw

CMSsite 1.0 SQL injection vulnerability documented as CVE-2019-25697

Related entities

Vulnerabilities

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Payload CMS SQL Injection Flaw Allows Low-Privilege Authenticated Attacks

SQL Injection Flaws Expose SourceCodester and CodeAstro Management Apps

CI4MS Stored DOM XSS Flaws Enable Account Takeover and Privilege Escalation