CVE-2018-25173
Published: 06 March 2026
Description
Rmedia SMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the gid parameter. Attackers can send GET requests to editgrp.php with malicious gid values using EXTRACTVALUE and CONCAT functions…
more
to retrieve schema names and sensitive database data.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the gid parameter in editgrp.php.
SI-2 mandates timely flaw remediation, directly addressing the SQL injection vulnerability in Rmedia SMS 1.0's editgrp.php.
RA-5 requires vulnerability scanning that would identify the SQL injection in editgrp.php and trigger remediation to prevent exploitation.
Security SummaryAI
CVE-2018-25173 is an SQL injection vulnerability (CWE-89) affecting Rmedia SMS version 1.0. The issue exists in the editgrp.php component, where the gid parameter fails to properly sanitize user input, allowing attackers to inject arbitrary SQL code.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction or privileges required, earning it a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By sending GET requests to editgrp.php with malicious gid values—leveraging functions such as EXTRACTVALUE and CONCAT—attackers can extract database schema names and other sensitive information, resulting in high confidentiality impact and low integrity impact.
Exploit details, including a proof-of-concept, are publicly available on Exploit-DB at https://www.exploit-db.com/exploits/45855. A Vulncheck advisory at https://www.vulncheck.com/advisories/rmedia-sms-sql-injection-via-editgrpphp documents the SQL injection via editgrp.php and provides additional technical analysis.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (editgrp.php) enables unauthenticated remote exploitation (T1190) and extraction of sensitive database information such as schema names (T1213.006).