CVE-2019-25366: Microasp Portal+ CMS Security Risk Alert

In the ever-evolving landscape of web vulnerabilities, CVE-2019-25366 stands out as a high-severity SQL injection flaw in the microASP Portal+ CMS.

Published on February 22, 2026, this issue affects all versions of the Italian-developed content management system (CMS) from vendor Microasp.

With a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A: N), it earns a “High” rating due to its potential for unauthenticated remote exploitation. No known exploits in the wild exist yet, but the risk of data exfiltration makes immediate action essential for exposed deployments.

Microasp Portal+ CMS Security Risk Alert

At its core, CVE-2019-25366 stems from CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’). The flaw resides in the pagina.phtml endpoint, where the explode_tree The parameter fails to sanitize user input.

Attackers can inject arbitrary SQL queries via crafted HTTP requests, leveraging MySQL functions like extractvalue() and concat() to bypass filters and extract sensitive data.

explode_tree=1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(0x717a6b7171,(SELECT database()),0x717a627171,0x717a6b7171,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--

This injects a blind SQL injection that leaks the current database name via error-based responses. Attackers chain such payloads to enumerate tables, dump user credentials, or harvest configuration data, all without authentication or user interaction.

Attribute	Details
CVE ID	CVE-2019-25366​
Severity	HIGH (CVSS v3.1: 8.2)​
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N ​
Vendor	Microasp​
Product	microASP Portal+ CMS (all versions) ​
CWE	CWE-89 (SQL Injection) ​

The vector string confirms network accessibility (AV: N), low complexity (AC:L), no privileges needed (PR: N), and high confidentiality impact (C: H), with minor integrity disruption (I:L) and no availability effects (A: N).

References like Exploit-DB (EDB-ID: 46799), the vendor site (microasp.it), and VulnCheck advisory details, with proof-of-concept exploits, underscore the ease of weaponization.

This vulnerability poses severe risks to organizations running microASP Portal+ CMS, particularly on internet-facing servers or in shared hosting environments. Attackers gain read access to the CMS’s database under its service account privileges, potentially exposing user data, admin hashes, API keys, or business logic.

In scope-unchanged attacks (S: U), impacts remain within the app’s trust boundary, but leaked credentials could be used for lateral movement.

High-risk targets include small-to-medium sites, such as local businesses, forums, or portals, that use outdated CMS instances. If your setup matches, assume compromise potential scales with exposure time.

Spotting exploitation requires vigilant monitoring:

• Web Logs: Hunt for anomalous requests to pagina.phtml with extractvalue, concat, UNION/SELECT, or comment evasion (--, /* */).
• Error Signals: SQL syntax errors, unusual database names in responses, or spikes in failed queries.
• Behavioral Anomalies: Traffic surges from unknown IPs targeting CMS paths; data exfiltration via oversized responses.
• Tools: Leverage WAFs (e.g., ModSecurity) with SQLi rules, SIEMs for log correlation, or scanners like Nuclei/Burp Suite that match EDB-46799 templates.

Prioritize based on exposure, treat as P1 if EPSS ≥0.5 or KEV-listed:

1. Patch Immediately: Check microasp.it for updates; test in staging before production.
2. Code Hardening: Refactor to parameterized queries/prepared statements; escape inputs in explode_tree.
3. DB Least Privilege: Lock down the CMS DB user to read-only on essentials; drop risky functions.
4. Defensive Layers: Deploy WAF rules to block SQL injection patterns; enable CSP and input validation.
5. Post-Fix Validation: Monitor SQL error rates and audit logs for 48-72 hours.

Proactive auditing via vulnerability scanners can prevent headaches. In a world of persistent threats, addressing CVE-2019-25366 shields your digital assets from silent data drains.

Site: cybersecuritypath.com

Reference: Source