Security readout for executives and security teams
Plain-English summary
Yahei-PHP Prober 0.4.7 has a web input handling flaw that can let an attacker inject HTML or script into a user’s browser through the speed parameter. Business impact is mainly user-session risk, phishing, or limited data exposure if an administrator or visitor follows a crafted link.
Executive priority
Handle as a targeted web exposure cleanup item, not an enterprise emergency. Prioritize quickly if the tool is internet-facing or used by privileged administrators. The practical decision is to restrict or remove the diagnostic page unless there is a clear operational need.
Technical view
CVE-2019-25280 is a CWE-79 HTML injection/cross-site scripting issue in prober.php in Yahei-PHP Prober 0.4.7. The CVSS 3.1 score is 6.1, with network attack vector, low complexity, no privileges required, and user interaction required. Scope is changed, with low confidentiality and integrity impact and no availability impact.
Likely exposure
Exposure is likely limited to internet-accessible or internal deployments of Yahei-PHP Prober 0.4.7. Organizations are most at risk if prober.php is reachable by browsers and used by administrators or support staff. No broader affected version range is provided in the source bundle.
Exploitation context
Public exploit listings and third-party advisories exist, including Packet Storm and Zero Science Lab. The provided sources do not show CISA KEV status or confirmed active exploitation. Successful exploitation requires a user to interact with a crafted request or link that reaches the vulnerable page.
Researcher notes
The CVE description and advisories identify the speed GET parameter in prober.php as the vulnerable input. Evidence supports reflected HTML injection/XSS characteristics. Sources do not provide a named patch, fixed version, or active exploitation confirmation. Avoid assuming other versions are affected without separate evidence.
Mitigation direction
- Identify any Yahei-PHP Prober installations and confirm whether version 0.4.7 is present.
- Restrict access to prober.php to trusted administrative networks or authenticated users.
- Remove the tool if it is not required for current operations.
- Check Yahei.Net or trusted advisory sources for any vendor update or replacement guidance.
- Treat public proof-of-concept availability as a reason to prioritize exposure reduction.
Validation and detection
- Search web roots and asset inventories for Yahei-PHP Prober and prober.php.
- Confirm version information where available, focusing on 0.4.7.
- Verify whether prober.php is reachable from the internet or untrusted networks.
- Review web logs for unusual requests containing the speed parameter.
- Confirm compensating controls limit access to trusted users or networks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25280 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- Zero Science Lab Vulnerability AdvisoryCVE reference · third-party-advisory
- Packet Storm Security Exploit EntryCVE reference · exploit
- CXSecurity Vulnerability ListingCVE reference · third-party-advisory
- IBM X-Force Vulnerability ExchangeCVE reference · vdb-entry
- Archived Yahei-PHP Product HomepageCVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.