CVE-2018-25176 - Vulnerability Analysis

Overview

Alive Parish 2.0.4 contains an SQL injection caused by unsanitized input in the key parameter of the search endpoint, letting unauthenticated attackers execute arbitrary SQL queries. It also contains an unrestricted file upload vulnerability in the person photo upload functionality, allowing remote code execution.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL queries and upload files for remote code execution, potentially compromising the entire system.

Mitigation

Update to the latest version that addresses these vulnerabilities.

References

• https://www.exploit-db.com/exploits/45840
• https://www.vulncheck.com/advisories/alive-parish-sql-injection-and-arbitrary-file-upload

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner