CVE-2019-25676 is a high severity flaw (CVSS 8.2) in Ask Expert Script 3.0.5 from PHP Scripts Mall, covering cross-site scripting and SQL injection through URL parameters. The record names no fix. Restrict the pages, encode output and use prepared statements.
What's affected
- Product: Ask Expert Script.
- Version: 3.0.5.
- Fixed version: none confirmed in the record or the advisory page I read. Check the vendor site.
- Weaknesses: CWE-79 cross-site scripting and CWE-89 SQL injection.
- CVSS 8.2, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
The record names two entry points. The cateid parameter in categorysearch.php can be used to inject script tags. The view parameter in list-details.php can be used to inject SQL.
How to check if you're exposed
Find the install, confirm the version, and look at how the two parameters are handled.
grep -rn "cateid\|\$_GET\['view'\]" --include=*.php /var/www 2>/dev/null
For the first, check whether the value is printed back into the page without encoding. For the second, check whether it is placed into a query by string building. A DAST scan against a staging copy will flag both patterns.
What to do now
- Find every Ask Expert Script install and confirm it is 3.0.5.
- Check the vendor for a fixed release. None is confirmed here.
- Encode the cateid value on output, using your template layer's HTML escaping.
- Switch the list-details.php query to a prepared statement.
- Restrict or take down the two pages if you cannot patch quickly.
- Review logs for odd values in those two parameters.
$stmt = $pdo->prepare('SELECT * FROM items WHERE id = :id');
$stmt->execute([':id' => $_GET['id']]);
Why it matters
Two classic input handling mistakes in one product show the same habit: request data is trusted. Reflected script injection lets an attacker run script in a visitor's browser under your site's name. SQL injection lets a visitor read your database. The vector shows network access, low complexity and no privileges.
The record lists a public Exploit-DB entry, and the CISA KEV flag is false. Details are public, but no attacks are confirmed.
Try it yourself
This walkthrough shows how a scan surfaces a weakness like this one and what the finding looks like.
Click through it at your own pace, or open it full screen.
Quick check
Which problem is worse here?
The SQL injection, because it reaches stored data. The script injection still matters if you have staff or customers who visit crafted links.
Sources
Last reviewed: 19 October 2026.
