CVE-2019-25527

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25527
Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the numguest parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads to bypass authentication, extract sensitive data, or modify database contents.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.exploit-db.com/exploits/46630 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/inout-easyrooms-ultimate-edition-sql-injection-via-searchdetailed Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:inoutscripts:inout_homestay:1.0:*:*:*:ultimate:*:*:*
History

19 Mar 2026, 16:24

Type Values Removed Values Added
CPE cpe:2.3:a:inoutscripts:inout_homestay:1.0:*:*:*:ultimate:*:*:*
References () https://www.exploit-db.com/exploits/46630 - () https://www.exploit-db.com/exploits/46630 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/inout-easyrooms-ultimate-edition-sql-injection-via-searchdetailed - () https://www.vulncheck.com/advisories/inout-easyrooms-ultimate-edition-sql-injection-via-searchdetailed - Third Party Advisory
First Time Inoutscripts
Inoutscripts inout Homestay
Summary
  • (es) Inout EasyRooms Ultimate Edition v1.0 contiene una vulnerabilidad de inyección SQL que permite a atacantes no autenticados manipular consultas de base de datos inyectando código SQL a través del parámetro numguest. Los atacantes pueden enviar solicitudes POST al endpoint search/searchdetailed con cargas útiles SQL maliciosas para eludir la autenticación, extraer datos sensibles o modificar el contenido de la base de datos.

12 Mar 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-12 16:16

Updated : 2026-03-19 16:24

NVD link : CVE-2019-25527

Mitre link : CVE-2019-25527

CVE.ORG link : CVE-2019-25527

JSON object : View

Products Affected

inoutscripts

  • inout_homestay
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')