CVE-2019-25459 Web Ofisi Emlak V2 SQL Injection via emlak-ara.html
Unauthenticated attackers can inject SQL code into GET parameters to extract sensitive database information or perform blind SQL injection attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25459?
CVE-2019-25459 is a high-severity SQL injection vulnerability in Web-ofisi Emlak, published on 22 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Web Ofisi Emlak V2 contains multiple SQL injection vulnerabilities in the endpoint that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into parameters like emlak_durumu, emlak_tipi, il, ilce, kelime, and semt to extract sensitive database information or perform time-based blind SQL injection attacks.
Weakness: CWE-89
Which versions are affected by CVE-2019-25459?
It affects 1 product.
Products include Web-Ofisi Emlak.
How do I fix CVE-2019-25459?
No fix has been published for CVE-2019-25459 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-25459 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25459 exists.
Other vulnerabilities in Web-ofisi Emlak
Sources
Also known as GHSA-w7wm-w9qw-pc72.