PT-2026-7925 · Unknown · Thrive Smart Home

Published 2026-02-12 · Updated 2026-02-12 · CVE-2019-25325

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Thrive Smart Home version 1.1

Description The application contains an SQL injection issue in the checklogin.php endpoint. Unauthenticated attackers can bypass authentication by manipulating the user POST parameter. Attackers can inject malicious SQL code, such as ' or 1=1#, to manipulate login queries and gain unauthorized access to the application.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the checklogin.php endpoint until a patch is available. Sanitize the user POST parameter to prevent SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-25325

Affected Products

Thrive Smart Home

References · 8

• 🔥 https://cxsecurity.com/issue/WLB-2020010019 · Exploit
• 🔥 https://packetstorm.news/files/id/155797 · Exploit
• 🔥 https://exploit-db.com/exploits/47814 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2019-5554.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25325 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/173728 · Note
• https://vulncheck.com/advisories/thrive-smart-home-smart-home-improper-limitation-o · Note
• https://t.me/CVEtracker/44568 · Telegram Post