PT-2026-22958 · Phpads · Phpads

Published 2026-03-04 · Updated 2026-03-04 · CVE-2019-25503

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPads version 2.0

Description PHPads 2.0 has an SQL injection issue. Unauthenticated attackers can execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in the ''click.php3'' file. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue to extract sensitive database information, such as the current database name.

Recommendations Apply updates to address the issue in PHPads version 2.0. As a temporary workaround, restrict access to the ''click.php3'' file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-25503

Affected Products

Phpads

References · 4

• 🔥 https://exploit-db.com/exploits/46798 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25503 · Security Note
• https://vulncheck.com/advisories/phpads-sql-injection-via-clickphp-bannerid · Note