CVE-2018-25204
🟠 Łataj w tym tygodniu
Wstrzyknięcie SQL w Library CMS 1.0 pozwala nieautoryzowanym atakującym na ominięcie uwierzytelnienia.
CVSS
8.2
EPSS
0.3%
Exploit
poc
Vendor
wecodex
Opis źródłowy (NVD)
Library CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can send POST requests to the admin login endpoint with boolean-based blind SQL injection payloads in the username field to manipulate database queries and gain unauthorized access.
auth-bypass exploit sql-injection
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.2 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.3% |
| Opublikowano (NVD) | 2026-03-26 12:16:05 UTC |
| Ostatnia modyfikacja (NVD) | 2026-03-31 01:15:27 UTC |
Referencje
- https://www.exploit-db.com/exploits/44728 (disclosure@vulncheck.com) [Exploit, VDB Entry, Third Party Advisory]
- https://www.vulncheck.com/advisories/library-cms-sql-injection-via-admin-login (disclosure@vulncheck.com) [Third Party Advisory]
- https://www.wecodex.com/item/view/library-management-system-in-php-and-mysql/1 (disclosure@vulncheck.com) [Broken Link]