CVE-2018-25210 - Vulnerability Analysis

Overview

WebOfisi E-Ticaret 4.0 contains an sql injection caused by unsanitized 'urun' GET parameter, letting unauthenticated attackers manipulate database queries and execute various SQL injection techniques.

Severity & Score

Impact

Unauthenticated attackers can manipulate database queries, potentially leading to data disclosure, modification, or full database compromise.

Mitigation

Update to the latest version of WebOfisi E-Ticaret.

References

• https://www.vulncheck.com/advisories/webofisi-e-ticaret-sql-injection-via-urun-parameter
• https://www.web-ofisi.com
• https://drive.google.com/file/d/1ZghFSsYto-Vpv3PXunx8xm2g-Gs3HJwz/view?usp=sharing
• https://www.exploit-db.com/exploits/45897

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner