CVE-2019-25527: Inout EasyRooms Ultimate Edition v1.0 SQL Injection via searchdetailed

Published Mar 12, 2026

Updated

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the numguest parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads to bypass authentication, extract sensitive data, or modify database contents.

Affected Software

2 affected components

Inout EasyRooms Ultimate Edition

Inoutscripts Inout Homestay=1.0

Event History

Mar 12, 2026

CVE Published

via MITRE·03:36 PM

Data Sourced

via MITRE·03:36 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-25527?

CVE-2019-25527 is considered a critical vulnerability due to its potential for SQL injection attacks.

How do I fix CVE-2019-25527?

To fix CVE-2019-25527, implement proper input validation and parameterized queries in your application.

Who is affected by CVE-2019-25527?

CVE-2019-25527 affects users of Inout EasyRooms Ultimate Edition v1.0.

What type of attack can CVE-2019-25527 facilitate?

CVE-2019-25527 can facilitate SQL injection attacks that allow attackers to manipulate database queries.

Can CVE-2019-25527 be exploited remotely?

Yes, CVE-2019-25527 can be exploited remotely by unauthenticated attackers.