VYPR
← All advisories
High severity7.1NVD Advisory· Published Mar 4, 2026· Updated Jun 17, 2026

CVE-2019-25503

CVE-2019-25503

Description

PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue to extract sensitive database information such as the current database name.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Blondish/Phpads2 versions
    cpe:2.3:a:blondish:phpads:2.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:blondish:phpads:2.0:*:*:*:*:*:*:*
    • (no CPE)range: 2.0
  • PHPads/PHPadsllm-create
    Range: =2.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.