CVE-2018-25204 - Vulnerability Analysis

Overview

Library CMS 1.0 contains an sql injection caused by unsanitized input in the username parameter at the admin login endpoint, letting unauthenticated attackers bypass authentication by injecting SQL code.

Severity & Score

Impact

Unauthenticated attackers can bypass authentication and gain unauthorized access to the system.

Mitigation

Update to the latest version of Library CMS.

References

• https://www.vulncheck.com/advisories/library-cms-sql-injection-via-admin-login
• https://www.wecodex.com/item/view/library-management-system-in-php-and-mysql/1
• https://www.exploit-db.com/exploits/44728

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner