CVE-2019-25490

Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Attackers can send GET requests to the admin/edit.php endpoint with time-based SQL injection payloads to extract sensitive database information.

Score

CVSS 4.0 8.8 High

Status

Analyzed - disclosure@vulncheck.com

Published

2026-02-27

Last modified

2026-04-07

Weaknesses

CWE-89

Affected products

• Airbnb Clone Script (Doditsolutions)
• Homey Bnb Airbnb Clone Script (Doditsolutions)

References

• https://www.doditsolutions.com/airbnb-clone-script/
• https://www.exploit-db.com/exploits/46616
• https://www.vulncheck.com/advisories/homey-bnb-sql-injection-via-admin-editphp