Security readout for executives and security teams
Plain-English summary
CVE-2019-25521 is an unauthenticated SQL injection in Xooscripts XooGallery. A remote attacker could tamper with database queries through the gal_id parameter and potentially read sensitive database data or alter contents. The CVSS 4.0 score is 8.8, making this a high-priority issue for any internet-facing deployment.
Executive priority
Prioritize this for immediate triage if XooGallery is externally reachable. The risk is high because exploitation requires no login and may expose database data. If the product is not used, document non-exposure and close after verification.
Technical view
The issue is CWE-89 SQL injection in XooGallery’s gal.php handling of gal_id. Sources describe network exploitation with low complexity, no privileges, and no user interaction. The CVSS vector indicates high confidentiality impact and low integrity impact, with no availability impact. Public exploit reference ExploitDB-46609 is listed.
Likely exposure
Exposure is most relevant for organizations running Xooscripts XooGallery, especially if gal.php is reachable from the internet. The source bundle lists affected versions as '*', but does not provide precise version ranges, deployment prevalence, or a vendor patch level.
Exploitation context
The vulnerability has a public ExploitDB reference, so defenders should assume exploit details are accessible. The provided sources do not indicate CISA KEV listing or confirmed active exploitation. Treat internet-exposed instances as higher risk because exploitation is unauthenticated and network reachable.
Researcher notes
Evidence is limited to CVE, VulnCheck, and ExploitDB references. The affected range is nonspecific, and no patch or vendor advisory is included in the provided bundle. Avoid assuming all forks or similarly named gallery products are affected without confirming Xooscripts XooGallery code presence.
Mitigation direction
- Inventory websites and applications for Xooscripts XooGallery use.
- Restrict public access to XooGallery until vendor guidance is confirmed.
- Check vendor or maintainer sources for patched versions or removal guidance.
- Apply available updates if confirmed by the vendor or trusted advisory.
- Use web application controls to block suspicious gal_id parameter abuse.
Validation and detection
- Identify whether gal.php from XooGallery is deployed and reachable.
- Review application logs for unusual gal_id requests.
- Confirm installed XooGallery version and source package provenance.
- Check whether database accounts used by the app have excessive privileges.
- Verify any compensating controls are active on internet-facing paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25521 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-46609CVE reference · exploit
- VulnCheck Advisory: XooGallery Lastest Latest SQL Injection via gal.php gal_idCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.