Web Ofisi Emlak V2 emlak-ara.html 存在 SQL 注入漏洞

An attacker exploiting CVE-2019-25459 can gain unauthorized access to sensitive data stored within the Web Ofisi Emlak database. By injecting malicious SQL code into GET parameters such as emlakdurumu, emlaktipi, il, ilce, kelime, and semt, an attacker can extract user credentials, property details, financial information, and other confidential data. The time-based blind SQL injection technique allows attackers to bypass input validation and extract data even without direct error messages. Successful exploitation could lead to complete database compromise and potentially allow an attacker to modify or delete data, disrupting the real estate management system’s functionality.

Organizations utilizing Web Ofisi Emlak V2 (2.0.0–V2) for real estate management are at significant risk. This includes small to medium-sized businesses relying on the system for property listings, client management, and financial tracking. Shared hosting environments where multiple users share the same server instance are particularly vulnerable, as a compromise of one user's instance could potentially lead to lateral movement and compromise other users’ data.

• php: Examine web server access logs for requests containing suspicious SQL syntax in GET parameters (e.g., emlak_durumu=1' OR '1'='1). • php: Review the source code of Web Ofisi Emlak, specifically the endpoint handling GET parameters, for unescaped user input used in SQL queries. • generic web: Use curl to test the vulnerable endpoints with various SQL injection payloads:

curl 'http://your-web-ofisi-instance/index.php?emlak_durumu=1' OR '1'='1'

• generic web: Monitor error logs for database-related errors that might indicate a SQL injection attempt.

1. 2026-02-22Disclosure

   disclosure

1. 已保留2026-02-22
2. 发布日期2026-02-22
3. 修改日期2026-04-07
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2019-25459 is to immediately upgrade Web Ofisi Emlak to version 2.5.4 or later. If upgrading is not immediately feasible, implement strict input validation and sanitization on all GET parameters to prevent SQL injection attacks. Consider using a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious requests. Regularly review database access logs for suspicious activity and implement the principle of least privilege for database users. After upgrading, confirm the fix by attempting to inject SQL code into the vulnerable GET parameters and verifying that the requests are properly sanitized and do not result in database errors.