CVE-2019-25459 | Web Ofisi Emlak V2 contains multiple SQL injection vulnerabi… | CVSS 9.8 CRITICAL

Description

Web Ofisi Emlak V2 contains multiple SQL injection vulnerabilities in the endpoint that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into parameters like emlak_durumu, emlak_tipi, il, ilce, kelime, and semt to extract sensitive database information or perform time-based blind SQL injection attacks.

Metadata

CVE ID: CVE-2019-25459
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-02-22 13:59 UTC
Published: 2026-02-22 14:12 UTC
Last updated: 2026-04-07 14:04 UTC
Primary CWE: CWE-89
Improper Neutralization of Special Elements used in an SQL C…
Vendor / Product: Web-ofisi / Emlak
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Web-ofisi	Emlak	—	V2

Weakness (CWE)

CWE	Source	Description
CWE-89	cna	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.8	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References (3)

ExploitDB-47142 https://www.exploit-db.com/exploits/47142
Official Product Homepage https://www.web-ofisi.com/detay/emlak-scripti-v3.html
VulnCheck Advisory: Web Ofisi Emlak V2 SQL Injection via emlak-ara.html https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-emlak-arahtml