CVE-2018-25195 - Vulnerability Analysis

Overview

Wecodex Hotel CMS 1.0 contains an sql injection caused by unsanitized input in the username parameter in admin login functionality, letting unauthenticated attackers bypass authentication and extract sensitive data.

Severity & Score

Impact

Unauthenticated attackers can bypass admin login and access sensitive database information, leading to full administrative control.

Mitigation

Update to the latest version with SQL injection fixes.

References

• https://www.exploit-db.com/exploits/44729
• https://www.vulncheck.com/advisories/wecodex-hotel-cms-sql-injection-via-admin-login
• https://www.wecodex.com/item/view/hotel-management-system-in-php-and-mysql/7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner