CVE-2018-25183 - Vulnerability Analysis

Overview

Shipping System CMS 1.0 contains an sql injection caused by unsanitized input in the username parameter at the admin login endpoint, letting unauthenticated attackers bypass authentication using boolean-based blind SQL injection.

Severity & Score

Impact

Unauthenticated attackers can bypass authentication, gaining unauthorized access to the system.

Mitigation

Update to the latest version of Shipping System CMS.

References

• https://www.exploit-db.com/exploits/44722
• https://www.vulncheck.com/advisories/shipping-system-cms-sql-injection-via-admin-login
• https://www.wecodex.com/item/view/shipping-system-by-parcel-in-php-and-mysql/4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner