PT-2026-26926 · Unknown · Phptransformer

Ihsan Sencan · Published 2026-03-21 · Updated 2026-03-21 · CVE-2019-25578

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpTransformer version 2016.9

Description The software contains an SQL injection issue that could allow remote attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to the ''GeneratePDF.php'' endpoint with SQL payloads in the idnews parameter to extract sensitive database information or manipulate queries.

Recommendations Apply updates to address the issue in phpTransformer version 2016.9. As a temporary workaround, restrict access to the ''GeneratePDF.php'' endpoint. Avoid using the idnews parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Path traversal

Weakness Enumeration

CWE-89

CWE-22

Related Identifiers

CVE-2019-25578

Affected Products

Phptransformer

References · 5

• 🔥 https://exploit-db.com/exploits/46191 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25578 · Security Note
• https://vulncheck.com/advisories/phptransformer-sql-injection-via-generatepdf-php · Note
• https://netcologne.dl.sourceforge.net/project/phptransformer/Version%202016.9/release_2016.9.zip · Note
• http://phptransformer.com · Note