CVE-2018-25189
Published: 06 March 2026
Description
Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive database information including usernames,…
more
database names, and version details.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation mechanisms on inputs like the username parameter in dca_login.php to reject crafted SQL payloads.
Ensures timely identification, reporting, and correction of the specific SQL injection flaw in Data Center Audit 2.6.2 to eliminate the vulnerability.
Enables monitoring of system activity to detect unauthorized SQL queries or indicators of SQL injection exploitation attempts.
Security SummaryAI
CVE-2018-25189 is an SQL injection vulnerability (CWE-89) in Data Center Audit version 2.6.2, specifically within the username parameter of the dca_login.php file. This flaw enables unauthenticated attackers to execute arbitrary SQL queries by submitting crafted payloads through POST requests, potentially compromising the underlying database.
The vulnerability can be exploited by unauthenticated remote attackers over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), resulting in a CVSS v3.1 base score of 8.2 (C:H/I:L/A:N). Exploitation allows attackers to extract sensitive information such as usernames, database names, and version details from the database.
Advisories and related resources, including those at https://www.vulncheck.com/advisories/data-center-audit-sql-injection-via-username-parameter and https://www.exploit-db.com/exploits/45807, document the issue and provide details on exploitation, such as proof-of-concept code. No specific patches or mitigation steps are detailed in the available information.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing login endpoint (T1190) enables unauthenticated remote extraction of database contents including usernames and system details (T1213.006).