CVE-2018-25185 - Vulnerability Analysis

Overview

Wecodex Restaurant CMS 1.0 contains an sql injection caused by unsanitized input in the username parameter at the login endpoint, letting unauthenticated attackers extract sensitive database information via blind SQL techniques.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database information, potentially compromising the entire database.

Mitigation

Update to the latest version of Wecodex Restaurant CMS.

References

• https://www.exploit-db.com/exploits/44730
• https://www.vulncheck.com/advisories/wecodex-restaurant-cms-sql-injection-via-login
• https://www.wecodex.com/item/view/restaurant-system-in-php-and-mysql/6

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner