CVE-2018-25166 - Vulnerability Analysis

Overview

Meneame English Pligg 5.8 contains an sql injection caused by unsanitized input in the search parameter in index.php, letting unauthenticated attackers execute arbitrary SQL queries and extract sensitive database information, exploit requires crafted GET requests.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL queries to extract sensitive database information.

Mitigation

Update to the latest version of Meneame English Pligg.

References

• https://www.exploit-db.com/exploits/45875
• https://www.vulncheck.com/advisories/meneame-english-pligg-sql-injection-via-search-parameter

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner